A user-controlled pointer in the drm_compat_ioctl path of the Linux kernel could be speculatively dereferenced into a table of function pointers, exposing the kernel to a Spectre‑type side‑channel attack. The vulnerability allows an attacker to influence speculative execution paths and potentially read or leak sensitive data during the execution of privileged code.

All Linux kernels that include the drm/ioc32 component are affected, regardless of vendor, because the issue resides in the core kernel source. No specific version range is provided, but any kernel compiled with the drm compatibility layer prior to the commit that introduced array_index_nospec() is at risk.

The risk is a side‑channel data leak rather than direct control of kernel code. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating limited or no proof‑of‑concept exploitation yet. CVSS score is not provided, but a Spectre‑like flaw is traditionally considered high risk. Exploitation would require influencing speculative execution, which is a complex privilege‑escalation vector.