CVE-2026-23316: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23316 is an alignment fault vulnerability in the Linux kernel's IPv4 multipath hash seed handling on ARM64 systems, specifically within the fib_multipath_hash_from_keys() function. The flaw manifests when the kernel is compiled with Clang and LTO (Link-Time Optimization) enabled, causing improper use of READ_ONCE() and WRITE_ONCE() macros on an 8-byte structure (sysctl_fib_multipath_hash_seed) with only 4-byte alignment. Affected Linux kernel versions include 6.11.1 through 6.12.76, 6.13 through 6.18.16, 6.19 through 6.19.6, as well as version 6.11 and 7.0 release candidates. It was published on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-468 (Incorrect Pointer Scaling), stemming from the misuse of READ_ONCE() on the full 8-byte sysctl_fib_multipath_hash_seed struct. When compiled with Clang and LTO, commit e35123d83ee3 strengthens READ_ONCE() to emit 64-bit Load-Acquire (ldar) instructions; since ARM64 strictly requires ldar to be naturally aligned, applying it to a 4-byte-aligned address triggers a strict Alignment Fault (FSC = 0x21) and fatal kernel panic. Additionally, WRITE_ONCE() on the entire struct causes Clang to split the 8-byte write into two non-atomic 32-bit str instructions, creating a tear-write vulnerability that can corrupt the multipath routing seed state. The fix involves moving READ_ONCE() directly to the u32 member and explicitly splitting writes into two 32-bit WRITE_ONCE() operations, plus adding a missing READ_ONCE() when reading user_seed (Red Hat Bugzilla).

Successful exploitation allows a low-privileged local attacker on an ARM64 system compiled with Clang and LTO to trigger a fatal kernel panic, resulting in a complete denial of service. The tear-write vulnerability in the write path can additionally cause inconsistent routing seed state, potentially corrupting multipath routing decisions and affecting network traffic processing. There is no confidentiality or integrity impact beyond routing configuration corruption; the primary risk is availability loss (Red Hat Advisory, Red Hat Bugzilla).

Apply the upstream Linux kernel patches resolving this issue: commits 4bdc94d45d54, 4ee7fa6cf78f, 607e923a3c1b, and 7e4ad34a8889 are available in the Linux kernel stable repository. Update to patched kernel versions: 6.12.77 or later, 6.18.17 or later, or 6.19.7 or later. If immediate patching is not feasible, restrict local system access to trusted users only, as exploitation requires low-privilege local access. As a temporary measure, consider recompiling the kernel with GCC instead of Clang+LTO to avoid triggering the alignment fault (Red Hat Bugzilla, Red Hat Advisory).

Red Hat documented the vulnerability via their security advisory and Bugzilla tracking system, noting it as medium severity. The upstream fix was coordinated through the Linux kernel CVE announcement mailing list (lore.kernel.org/linux-cve-announce). Multiple Linux distributions including Amazon Linux 2023, Debian, SUSE, and openSUSE have issued advisories and updated packages in response (Red Hat Advisory, Red Hat Bugzilla).