CVE-2026-23354 — Processor Optimization Removal or Modification of Security-critical Code in Linux
Severity
3.3LOW
No vectorEPSS
0.0%
top 93.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
x86/fred: Correct speculative safety in fred_extint()
array_index_nospec() is no use if the result gets spilled to the stack, as
it makes the believed safe-under-speculation value subject to memory
predictions.
For all practical purposes, this means array_index_nospec() must be used in
the expression that accesses the array.
As the code currently stands, it's the wrong side of irqentry_enter(), and
'index' is put into %ebp a…
Affected Packages3 packages
▶CVEListV5linux/linux14619d912b658ecd9573fb88400d3830a29cadcb — 3bc5887b0a2b06d2d9c22f1f4f8500490b3ae643+4
🔴Vulnerability Details
4GHSA▶
GHSA-4jgp-jccm-6ppx: In the Linux kernel, the following vulnerability has been resolved:
x86/fred: Correct speculative safety in fred_extint()
array_index_nospec() is no↗2026-03-25
OSV▶
CVE-2026-23354: In the Linux kernel, the following vulnerability has been resolved: x86/fred: Correct speculative safety in fred_extint() array_index_nospec() is no u↗2026-03-25