CVE-2026-23316

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: ipv4: fix ARM64 alignment fault in multipath hash seed

`struct sysctl_fib_multipath_hash_seed` contains two u32 fields

(user_seed and mp_seed), making it an 8-byte structure with a 4-byte

alignment requirement.

In `fib_multipath_hash_from_keys()`, the code evaluates the entire

struct atomically via `READ_ONCE()`:

mp_seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed).mp_seed;

While this silently works on GCC by falling back to unaligned regular

loads which the ARM64 kernel tolerates, it causes a fatal kernel panic

when compiled with Clang and LTO enabled.

Commit e35123d83ee3 ("arm64: lto: Strengthen READ_ONCE() to acquire

when CONFIG_LTO=y") strengthens `READ_ONCE()` to use Load-Acquire

instructions (`ldar` / `ldapr`) to prevent compiler reordering bugs

under Clang LTO. Since the macro evaluates the full 8-byte struct,

Clang emits a 64-bit `ldar` instruction. ARM64 architecture strictly

requires `

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References