CVE-2026-53346

What it actually does

This flaw affects Linux kernel builds on arm64 that include Rust code and unwind-table support. Because of a rustc behavior, compiler-generated Rust functions may receive incomplete unwind table annotations at the LLVM module level. When CONFIG_UNWIND_PATCH_PAC_INTO_SCS is enabled, the kernel’s boot-time patching logic can incorrectly patch pointer-authentication prologue/epilogue instructions, creating a mismatch such as patching paciasp without the corresponding autiasp. The documented failure mode is a kernel crash during boot, including KASAN global-out-of-bounds reports when constructors are invoked during early initialization. Practical exploitability appears limited and configuration-dependent; there is no known public exploit and EPSS is very low.

Why it matters to the business

Organizations running affected Linux kernel builds may experience failed boots, kernel panics, or instability on arm64 systems using the relevant Rust, KASAN, unwind-table, PAC, and shadow-call-stack configurations. The primary operational risk is availability loss for systems that cannot reliably boot after deploying a vulnerable kernel. Because this is not in CISA KEV, is not associated with ransomware use, has no known exploit maturity, and has a low EPSS score, emergency internet-exposure response is generally less urgent than controlled kernel build validation and patch planning.

How an attack unfolds

An attacker would generally need local access or influence over kernel build, deployment, or execution conditions, because the flaw is tied to how an affected arm64 Linux kernel is compiled and initialized rather than to a remotely reachable service. In the vulnerable configuration, Rust-generated kernel constructors may lack the expected module-level unwind-table metadata. During early boot, the kernel’s SCS/PAC patching logic interprets the incorrect unwind information and patches authentication instructions inconsistently. When the affected constructor is later called, the inconsistent prologue/epilogue state can cause a crash or memory-safety fault. There is no indication from the provided data that this is being exploited in the wild or that a weaponized exploit is publicly available.

How to fix it

Upgrade to a Linux kernel version that includes the upstream fix for this issue from the affected distribution or kernel vendor. Where exact fixed package versions are not available, track vendor advisories for CVE-2026-53346 and deploy the first kernel update that explicitly includes the Rust arm64 unwind-table module flag fix. For custom kernel builders, ensure the build logic sets the LLVM uwtable module flag when CONFIG_UNWIND_TABLES is enabled for affected rustc versions. Rust 1.98.0 is expected to include the underlying rustc fix; once using a fixed rustc, the additional flag is harmless or can be made version-conditional. As a mitigation where patching is not immediately possible, avoid deploying affected custom arm64 kernels built with the vulnerable combination of Rust support, CONFIG_UNWIND_TABLES, CONFIG_UNWIND_PATCH_PAC_INTO_SCS, and related sanitizer/debug options, especially KASAN, until they are rebuilt with the corrected flags.

How to confirm the fix worked

Confirm the running or staged kernel package includes the vendor fix for CVE-2026-53346. For custom kernels, review build configuration and compiler behavior to verify that arm64 Rust kernel objects built with CONFIG_UNWIND_TABLES receive the required LLVM uwtable module flag. Validate that affected systems can complete a full reboot cycle without early-boot kernel panic, KASAN global-out-of-bounds reports, or crashes in do_basic_setup, do_ctors, or Rust-generated constructor paths. On systems where kernel configs are exposed, check /proc/config.gz, /boot/config-$(uname -r), or distribution-equivalent kernel config sources for CONFIG_UNWIND_TABLES and CONFIG_UNWIND_PATCH_PAC_INTO_SCS. Also verify the rustc version used for kernel builds; rustc 1.98.0 or later is expected to contain the underlying compiler-side fix.

Typical attack path

1. Obtain local access or influence over a system that boots an affected arm64 Linux kernel build.
2. Identify that the kernel was built with Rust support and relevant options such as CONFIG_UNWIND_TABLES and CONFIG_UNWIND_PATCH_PAC_INTO_SCS.
3. Trigger or wait for early boot initialization paths that invoke affected compiler-generated Rust constructors.
4. The kernel performs incorrect SCS/PAC boot-time patching because unwind metadata is incomplete.
5. The affected constructor executes and the system crashes, panics, or reports a KASAN memory error.

How to detect it

To determine whether this issue has already affected systems, review kernel logs, serial console captures, bootloader logs, crash dumps, pstore/ramoops records, and system journal entries from failed or unstable boots. Focus on early boot failures on arm64 kernels built with Rust support and unwind-table/PAC/SCS options. Look for KASAN reports, kernel panics, or crashes mentioning do_basic_setup, do_ctors, constructor invocation, paciasp/autiasp mismatch, or KASAN global-out-of-bounds. This vulnerability is not expected to leave conventional network indicators. Evidence is more likely to appear as boot-time kernel crash artifacts than as application logs, process execution traces, or remote exploit telemetry.

• BUG: KASAN: global-out-of-bounds in do_basic_setup
• do_basic_setup+0x4c/0x90
• do_ctors
• (*fn)()
• asan.module_ctor
• paciasp
• autiasp
• CONFIG_UNWIND_PATCH_PAC_INTO_SCS
• CONFIG_UNWIND_TABLES
• KASAN: global-out-of-bounds
• Read of size 8 at addr
• swapper/0/1

What your security team should do

• Inventory arm64 Linux systems and custom kernel build pipelines that enable Rust support, CONFIG_UNWIND_TABLES, CONFIG_UNWIND_PATCH_PAC_INTO_SCS, KASAN, PAC, or shadow-call-stack features.
• Prioritize patching or rebuilding kernels used in production boot paths, embedded devices, appliances, and fleets where failed boot recovery is operationally difficult.
• For vendor kernels, monitor distribution advisories and deploy the first kernel package that explicitly remediates CVE-2026-53346.
• For custom kernels, update build logic to apply the uwtable LLVM module flag fix and plan migration to rustc 1.98.0 or later when available.
• Before broad rollout, perform reboot validation on representative arm64 hardware or virtual platforms and review kernel logs for early-boot KASAN, panic, or constructor-related failures.
• Because there is no KEV listing, no ransomware association, no known exploit maturity, and low EPSS, treat this as a reliability and hardening issue unless local exploit evidence appears in logs or advisories.