Cloudanix VulnDB

CVE-2026-23316

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A Linux kernel bug can crash ARM64 servers using certain compiler settings when network routing options are changed, leading to unexpected downtime.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

READ_ONCE() and WRITE_ONCE() on an 8-byte struct with 4-byte alignment in fib_multipath_hash_from_keys() and proc_fib_multipath_hash_set_seed() emit misaligned 64-bit ldar or split writes under Clang+LTO on ARM64, triggering alignment faults or atomicity loss.

Why it matters to the business

Systems compiled with Clang and LTO on ARM64 hardware can experience sudden kernel panics during multipath routing configuration changes, causing network outages and requiring reboots with no remote code execution risk.

How an attack unfolds

An attacker with local privileges modifies the sysctl_fib_multipath_hash_seed via procfs or triggers fib_multipath_hash_from_keys() under the affected compiler flags, causing the kernel to execute an unaligned load-acquire instruction that faults and panics the system.

How to fix it

Upgrade to a kernel containing the fix that applies READ_ONCE() and WRITE_ONCE() directly to the individual u32 fields; rebuild with the corrected atomic access patterns when using Clang+LTO.

How to confirm the fix worked

Confirm the kernel source contains direct 32-bit READ_ONCE/WRITE_ONCE on user_seed and mp_seed members; test compilation under Clang+LTO and verify no alignment faults occur during sysctl operations on ARM64.

Typical attack path

  1. Obtain local user access on an ARM64 Linux system built with Clang+LTO
  2. Write to net.ipv4.fib_multipath_hash_seed or invoke multipath route hash functions
  3. Trigger the strengthened READ_ONCE() emitting ldar on the misaligned struct
  4. Kernel raises alignment fault (FSC 0x21) and panics

How to detect it

Search kernel logs and dmesg for alignment fault messages (FSC=0x21) or panic traces referencing fib_multipath_hash_from_keys or sysctl_fib_multipath_hash_seed around times of routing table changes.

  • Alignment fault (FSC = 0x21)
  • fib_multipath_hash_from_keys
  • proc_fib_multipath_hash_set_seed

What your security team should do

  • Prioritize upgrade for all ARM64 systems built with Clang and LTO enabled
  • Audit kernel build configurations to identify Clang+LTO usage
  • Monitor for kernel oops or alignment fault logs in dmesg after sysctl changes
  • Apply the patch that splits struct accesses into per-field atomic operations

The record

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix ARM64 alignment fault in multipath hash seed `struct sysctl_fib_multipath_hash_seed` contains two u32 fields (user_seed and mp_seed), making it an 8-byte structure with a 4-byte alignment requirement. In `fib_multipath_hash_from_keys()`, the code evaluates the entire struct atomically via `READ_ONCE()`: mp_seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed).mp_seed; While this silently works on GCC by falling back to unaligned regular loads which the ARM64 kernel tolerates, it causes a fatal kernel panic when compiled with Clang and LTO enabled. Commit e35123d83ee3 ("arm64: lto: Strengthen READ_ONCE() to acquire when CONFIG_LTO=y") strengthens `READ_ONCE()` to use Load-Acquire instructions (`ldar` / `ldapr`) to prevent compiler reordering bugs under Clang LTO. Since the macro evaluates the full 8-byte struct, Clang emits a 64-bit `ldar` instruction. ARM64 architecture strictly requires `ldar` to be naturally aligned, thus executing it on a 4-byte aligned address triggers a strict Alignment Fault (FSC = 0x21). Fix the read side by moving the `READ_ONCE()` directly to the `u32` member, which emits a safe 32-bit `ldar Wn`. Furthermore, Eric Dumazet pointed out that `WRITE_ONCE()` on the entire struct in `proc_fib_multipath_hash_set_seed()` is also flawed. Analysis shows that Clang splits this 8-byte write into two separate 32-bit `str` instructions. While this avoids an alignment fault, it destroys atomicity and exposes a tear-write vulnerability. Fix this by explicitly splitting the write into two 32-bit `WRITE_ONCE()` operations. Finally, add the missing `READ_ONCE()` when reading `user_seed` in `proc_fib_multipath_hash_seed()` to ensure proper pairing and concurrency safety.

Affected packages

Ecosystem Package Introduced Fixed