CVE-2026-23316

The vulnerability resides in the Linux kernel's IPv4 multipath routing code. The struct sysctl_fib_multipath_hash_seed contains two u32 fields (user_seed and mp_seed), making it an 8-byte structure with only a 4-byte alignment requirement. In fib_multipath_hash_from_keys(), the code uses READ_ONCE() on the entire struct to read mp_seed. When the kernel is compiled with Clang and Link-Time Optimization (LTO), READ_ONCE() is strengthened to a 64-bit Load-Acquire instruction (ldar), which ARM64 architecture mandates must be naturally aligned (8-byte). Executing ldar on a 4-byte aligned address triggers a strict alignment fault (FSC = 0x21), leading to a kernel panic.

Exploitation requires no special privileges beyond the ability to trigger IPv4 multipath routing decisions. Any process that causes the kernel to evaluate the multipath hash seed—for example, by sending network traffic over a multipath route—can trigger the fault. The bug is architecture-specific to ARM64 and only manifests under Clang LTO builds, but it can be reliably triggered by normal network operations.

The impact is a denial of service: an unprivileged attacker can cause a kernel panic, crashing the system. The CVSS v3 score of 5.5 (Medium) reflects the availability impact and the local nature of the trigger (network access is sufficient).

The fix, applied in multiple stable kernel commits [1][2][3][4], addresses both the read and write sides. On the read side, READ_ONCE() is moved to the individual u32 member, emitting a safe 32-bit ldar. On the write side in proc_fib_multipath_hash_set_seed(), the 8-byte write is split into two 32-bit WRITE_ONCE() operations to restore atomicity. Additionally, a missing READ_ONCE() is added when reading user_seed in proc_fib_multipath_hash_seed() for proper concurrency safety. Users should update to a kernel containing these fixes.