CVE-2026-45993: Linux Kernel Privilege Escalation Issue

CVE-2026-45993 Overview

CVE-2026-45993 is a Linux kernel vulnerability affecting the LoongArch architecture. The syscall dispatch path accepts a syscall number controlled directly by userspace without applying an array_index_nospec() boundary check. This omission allows speculative execution to access memory past the syscall function pointer table, exposing the kernel to Spectre v1 style side-channel attacks. The fix introduces a speculation barrier on the syscall index to prevent out-of-bounds speculative loads against the syscall dispatch tables.

Critical Impact
Local userspace processes on LoongArch systems can leverage speculative execution to read kernel memory beyond the syscall table, potentially leaking sensitive kernel data.

Affected Products

Linux kernel on the LoongArch architecture (upstream)
Stable kernel branches receiving the backported fix commits
Linux distributions shipping LoongArch kernels prior to the referenced commits

Discovery Timeline

2026-05-27 - CVE-2026-45993 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45993

Vulnerability Analysis

The vulnerability resides in the LoongArch syscall entry path within the Linux kernel. When a user process issues a system call, the kernel uses the syscall number supplied by userspace to index into a function pointer table that maps numbers to handlers. The LoongArch implementation validated the syscall number architecturally but did not apply a Spectre v1 mitigation on the bounds-checked index.

Under speculative execution, the processor may proceed past the bounds check and load a function pointer from an attacker-influenced offset beyond the syscall table. While the speculated dispatch is later squashed, microarchitectural side effects such as cache state changes persist. An attacker can prime and probe those side effects to infer the contents of kernel memory adjacent to the dispatch table.

This is a kernel-level information disclosure issue rooted in missing input sanitization for speculative paths [CWE-1037]. It does not yield direct code execution, but it weakens kernel address space protections and can be chained with other primitives.

Root Cause

The LoongArch syscall dispatcher omitted a call to array_index_nospec() after validating the syscall number. Architectural bounds checks alone do not prevent speculative out-of-bounds indexing, leaving the table lookup vulnerable to Spectre variant 1 exploitation.

Attack Vector

A local unprivileged attacker invokes the syscall entry point with crafted syscall numbers and constructs a Spectre v1 gadget around the dispatch table. By measuring cache timing after speculation, the attacker recovers byte values from kernel memory regions reachable through speculative indexing of the syscall function pointer arrays.

The vulnerability mechanism is described in the upstream commit notes. See the Kernel Git Commit 85cbf7fb and related Kernel Git Commit 108f2cd1 for the source-level fix details.

Detection Methods for CVE-2026-45993

Indicators of Compromise

No specific file-based or network IOCs exist; exploitation occurs entirely through speculative execution side channels and leaves no persistent forensic artifacts.
Unexpected processes performing high-frequency syscall invocations with invalid or boundary-crossing syscall numbers on LoongArch hosts.

Detection Strategies

Audit running LoongArch kernel versions against the patched commits referenced in git.kernel.org to identify unpatched hosts.
Monitor for processes generating anomalous syscall traffic patterns consistent with cache timing probes, such as repeated invalid syscall numbers paired with timing-sensitive workloads.
Use kernel tracing tools such as ftrace or perf to baseline normal syscall distributions and flag deviations.

Monitoring Recommendations

Enable kernel audit logging for syscall entry events on LoongArch systems and forward to a centralized log platform.
Track kernel package versions across the fleet and alert on systems running LoongArch builds predating the fix commits.
Correlate userland behavior with kernel telemetry to identify potential side-channel reconnaissance activity.

How to Mitigate CVE-2026-45993

Immediate Actions Required

Apply the upstream Linux kernel patches that introduce array_index_nospec() on the LoongArch syscall dispatch path.
Update LoongArch hosts to a distribution kernel that incorporates the referenced stable commits.
Restrict local access on LoongArch systems to trusted users until patching is complete, since exploitation requires local code execution.

Patch Information

The fix is delivered through the following upstream commits: Kernel Git Commit 07040904, Kernel Git Commit 0c965d27, Kernel Git Commit 108f2cd1, Kernel Git Commit 85cbf7fb, and Kernel Git Commit bc84a109. Each commit adds the speculation barrier to bounds-checked syscall index usage in the LoongArch entry path.

Workarounds

Limit local shell access on affected LoongArch hosts to reduce the attack surface for local Spectre v1 exploitation.
Disable or restrict execution of untrusted code, including unprivileged containers and sandboxed workloads, until the kernel is patched.
Apply existing hardware and compiler Spectre v1 mitigations distribution-wide and confirm they are enabled at boot.

bash

# Verify the running kernel version on a LoongArch host
uname -r

# Confirm Spectre-related mitigations exposed by the kernel
grep -r . /sys/devices/system/cpu/vulnerabilities/ 2>/dev/null