CVE-2026-23354: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23354 is a speculative execution vulnerability in the Linux kernel's x86/fred (Flexible Return and Event Delivery) interrupt handling subsystem. The flaw exists in the fred_extint() function, where the array_index_nospec() Spectre mitigation is incorrectly positioned, rendering it ineffective against speculative out-of-bounds array access. Affected Linux kernel versions include 6.9 through 6.12.76, 6.13 through 6.18.16, 6.19.0 through 6.19.6, and 7.0-rc1 through 7.0-rc7. It was disclosed on March 25, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-1037 (Processor Optimization Removal or Modification of Security-critical Code) and CWE-129 (Improper Validation of Array Index). In fred_extint(), the array_index_nospec() call is placed before irqentry_enter(), causing the sanitized index value to be spilled into the %ebp register across the function call boundary and stored on the stack. Because the stack is subject to memory predictions by the CPU's speculative execution engine, the protection is nullified — a speculative attacker can still influence the array access with an out-of-bounds index. The fix removes the intermediate index variable and repositions array_index_nospec() so it is evaluated immediately at the point of array access, eliminating the speculative window (Red Hat Bugzilla, Red Hat Advisory).

A local attacker with low privileges could exploit this vulnerability to read sensitive kernel memory through speculative execution side-channel techniques, potentially disclosing kernel data structures, cryptographic material, or other privileged information. The vulnerability may also be leveraged to trigger denial-of-service conditions. The scope is limited to the local system; however, information disclosed from kernel memory could facilitate further privilege escalation or lateral movement within a compromised environment (Red Hat Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of near-term exploitation. Exploitation requires local access with at least low-privilege credentials and targets x86 systems with the FRED interrupt delivery mechanism enabled (Red Hat Advisory).

Apply kernel updates to the following fixed versions: 6.12.77 or later, 6.18.17 or later, 6.19.7 or later, or 7.0-rc2 or later. Specific upstream patch commits are available at git.kernel.org: 3bc5887b0a2b, 92caa5274b99, aa280a08e7d8, and e58f1a9b0677. Distribution-specific updates have been issued by Red Hat, SUSE (SUSE-SU-202621834-1, SUSE-SU-20262217-1, SUSE-SU-20262238-1), and Amazon Linux 2023 (ALAS2023-2026-1543, ALAS2023-2026-1596). Until patching is complete, restrict local user access on affected systems and consider enforcing mandatory access control policies (e.g., SELinux, AppArmor) to limit exploitation opportunities (Red Hat Advisory, Red Hat Bugzilla).

Red Hat tracked the issue via its Security Response process and assigned medium severity in its Bugzilla instance. SUSE issued multiple security advisories addressing the vulnerability across its enterprise Linux product lines. Amazon Linux 2023 also released advisories. No notable independent researcher commentary or significant social media discussion has been observed for this vulnerability.