LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint()

In the Linux kernel, the following vulnerability has been resolved: x86/fred: Correct speculative safety in fred_extint() array_index_nospec() is no use if the result gets spilled to the stack, as it makes the believed safe-under-speculation value subject to memory predictions. For all practical purposes, this means array_index_nospec() must be used in the expression that accesses the array. As the code currently stands, it's the wrong side of irqentry_enter(), and 'index' is put into %ebp across the function call. Remove the index variable and reposition array_index_nospec(), so it's calculated immediately before the array access.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2026-23354 is a Linux kernel speculative-execution safety flaw in the x86 FRED external interrupt path. The issue is technical and hardware-path-specific; the source bundle provides no CVSS score, CWE, or confirmed impact. Treat it as a kernel maintenance priority, not an emergency, unless your fleet runs affected x86 kernels.

Executive priority

Schedule remediation through the normal kernel patch cycle, with higher priority for internet-facing, multi-tenant, or high-sensitivity x86 Linux systems. Escalate only if vendor advisories later assign high impact or report exploitation.

Technical view

In fred_extint(), array_index_nospec() was applied too early, before irqentry_enter(), and the sanitized index could be carried across a call and spilled. The fix removes the separate index variable and applies array_index_nospec() immediately at array access, preserving speculative safety.

Likely exposure

Exposure is likely limited to Linux systems using affected x86 kernel versions or downstream kernels that include the vulnerable FRED code. The source metadata lists Linux kernel versions including 6.9, 6.12.77, 6.18.17, 6.19.7, and 7.0, but distro backport status must be checked separately.

Exploitation context

The bundle does not report active exploitation, a public exploit, KEV inclusion, CVSS, or a complete impact statement. It describes a speculative-safety correction in kernel interrupt handling, so risk assessment should focus on affected kernel presence and vendor advisories.

Researcher notes

The key behavior is placement of array_index_nospec(): the corrected code applies it in the array-access expression. Source evidence is limited to the CVE description and stable commit references; impact boundaries and exploitability are not fully described.

Mitigation direction

  • Check Linux distribution advisories for CVE-2026-23354 coverage and backported fixes.
  • Prioritize kernel updates on x86 systems running affected or adjacent kernel branches.
  • Use vendor-supported kernel packages rather than manually cherry-picking patches where possible.
  • Track the referenced stable kernel commits for fixed-code lineage.

Validation and detection

  • Inventory Linux kernel versions across x86 servers, workstations, and appliances.
  • Confirm whether deployed kernels include x86 FRED support or related backports.
  • Compare installed kernel source/package changelogs against the referenced stable commits.
  • Record systems awaiting reboot after kernel package updates.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23354 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux14619d912b658ecd9573fb88400d3830a29cadcb, 14619d912b658ecd9573fb88400d3830a29cadcb, 14619d912b658ecd9573fb88400d3830a29cadcb, 14619d912b658ecd9573fb88400d3830a29cadcbunaffected
LinuxLinux6.9, 0, 6.12.77, 6.18.17, 6.19.7, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.