ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-23316

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix ARM64 alignment fault in multipath hash seed contains two u32 fields (user_seed and…

Published Mar 25, 2026 · catalog updated Jun 17, 2026 · linux kernel

Check if you run it

No confirmed exploitation is on record for CVE-2026-23316. EPSS is 0.12%. Act only if a listed version of linux kernel is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.12%
Remediation
Advisory link
Affected products
cpe linux/linux kernel

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix ARM64 alignment fault in multipath hash seed contains two u32 fields (user_seed and mp_seed), making it an 8-byte structure with a 4-byte alignment requirement. In , the code evaluates the entire struct atomically via : mp_seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed).mp_seed; While this silently works on GCC by falling back to unaligned regular loads which the ARM64 kernel tolerates, it causes a fatal kernel panic when compiled with Clang and LTO enabled. Commit e35123d83ee3 ("arm64: lto: Strengthen READ_ONCE() to acquire when CONFIG_LTO=y") strengthens to use Load-Acquire instructions ( / ) to prevent compiler reordering bugs under Clang LTO. Since the macro evaluates the full 8-byte struct, Clang emits a 64-bit instruction. ARM64 architecture strictly requires to be naturally aligned, thus executing it on a 4-byte aligned address triggers a strict Alignment Fault (FSC = 0x21). Fix the read side by moving the directly to the member, which emits a safe 32-bit . Furthermore, Eric Dumazet pointed out that on the entire struct in is also flawed. Analysis shows that Clang splits this 8-byte write into two separate 32-bit instructions. While this avoids an alignment fault, it destroys atomicity and exposes a tear-write vulnerability. Fix this by explicitly splitting the write into two 32-bit operations. Finally, add the missing when reading in to ensure proper pairing and concurrency safety.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe linux/linux kernel6.11
  • cpe linux/linux kernel7.0

How to fix CVE-2026-23316

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-23316. EPSS is 0.12%. Act only if a listed version of linux kernel is installed.

Which versions are affected?

Compare what you have installed with linux/linux kernel 6.11; linux/linux kernel 7.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.12%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 25, 2026 · NIST NVD

    Detected

    In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix ARM64 alignment fault in multipath hash seed contains two u32 fields (user_seed and mp_seed), making it an 8-byte structure with a 4-byte alignment requirement. In , the code evaluates the entire struct atomically via : mp_seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed).mp_seed; While this silently works

  2. Jun 17, 2026 · NIST NVD

    Updated

    In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix ARM64 alignment fault in multipath hash seed contains two u32 fields (user_seed and mp_seed), making it an 8-byte structure with a 4-byte alignment requirement. In , the code evaluates the entire struct atomically via : mp_seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed).mp_seed; While this silently works

Sources

  • CVE.orgVulnerability recordCVE-2026-23316

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-23316

    30-day exploitation probability 0.1%

    first.org
  • NIST NVDVulnerability recordCVE-2026-23316

    In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix ARM64 alignment fault in multipath hash seed contains two u32 fields (user_seed and mp_seed), making it an 8-byte structure with a 4-byte alignment require

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.