CVE-2026-31483 s390/syscalls: Add spectre boundary for syscall dispatch table
Attackers can exploit missing Spectre mitigations in s390 syscall dispatch to read sensitive kernel memory via speculative execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31483?
CVE-2026-31483 is a medium-severity vulnerability in Linux kernel, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
s390/syscalls: Add spectre boundary for syscall dispatch table
The s390 syscall number is directly controlled by userspace, but does not have an array_index_nospec() boundary to prevent access past the syscall function pointer tables.
Which versions are affected by CVE-2026-31483?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31483?
Apply the vendor's patch.
Is CVE-2026-31483 being exploited?
There is no known exploitation of CVE-2026-31483 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-83306, BELL-CVE-2026-31483, DEBIAN-CVE-2026-31483, GHSA-44v7-9mpr-qvfc, ROOT-OS-DEBIAN-12-CVE-2026-31483, ROOT-OS-DEBIAN-13-CVE-2026-31483 and 3 more.