What is the CVSS score of CVE-2026-23316?

CVE-2026-23316 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-23316?

Yes, a patch is available for CVE-2026-23316. Update the affected software to the latest version immediately.

Linux CVE-2026-23316

EUVD-2026-15263 MEDIUM

2026-03-25 Linux

Information Disclosure Linux

5.5

CVSS 3.1 · NVD

View

Vulnerability Assessment

Impact

While CVSS and EPSS scores are not assigned in the CVE record, the vulnerability presents a moderate-to-high real-world risk despite being a local denial of service. The attack vector is local, but the impact is severe: kernel panic and system crash. The vulnerability is not publicly exploitable in a remote sense, but any local process that triggers multipath hash operations (common in systems with ECMP routing enabled) could inadvertently cause a crash. The fact that this only manifests when compiled with Clang and LTO—increasingly common in modern distributions and kernel builds—increases its impact scope. ARM64 systems are particularly affected due to strict alignment enforcement compared to x86_64 which silently tolerates unaligned operations. Patch availability exists across multiple stable kernel branches (references show commits 4bdc94d45d54, 7e4ad34a8889, 607e923a3c1b, and 4ee7fa6cf78f), indicating this was treated as a fix-priority issue upstream. The vulnerability is not listed as being actively exploited (no KEV status) and requires local code execution context, but the deterministic nature of the crash (strict architectural requirement) and widespread multipath routing deployments make this a legitimate priority for ARM64 deployments running Clang-compiled kernels.

Exploit ScenarioDerived

A system administrator on an ARM64 Linux server compiled with Clang and LTO attempts to enable multipath routing (Equal-Cost Multi-Path) for load balancing across network interfaces. When the kernel's multipath routing hash function accesses the sysctl_fib_multipath_hash_seed structure via READ_ONCE(), the Clang compiler emits a 64-bit Load-Acquire instruction targeting a 4-byte aligned address, triggering an immediate ARM64 alignment fault that crashes the kernel. Alternatively, a local process could trigger the same crash by reading or writing the multipath hash seed sysctl parameters via /proc/sys/net/ipv4/fib_multipath_hash_seed, causing denial of service. No special privilege escalation is required beyond local access to trigger this code path.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 25, 2026

A memory alignment fault vulnerability exists in the Linux kernel's IPv4 multipath routing hash seed implementation that causes kernel panics on ARM64 systems when compiled with Clang and Link Time Optimization (LTO) enabled. The vulnerability affects all Linux kernel versions with the vulnerable code path in net/ipv4/route.c, specifically impacting ARM64 architectures where strict alignment requirements for Load-Acquire instructions are enforced. An attacker with local access or ability to trigger multipath hash operations could cause a denial of service by crashing the kernel, though no active exploitation has been reported in the wild.

RemediationAI

Upgrade to a Linux kernel version that includes the alignment fix patches referenced in the stable kernel commits. For ARM64 systems running Clang-compiled kernels with LTO enabled, apply the patches that move READ_ONCE() directly to individual 32-bit u32 fields in the multipath hash seed structure and explicitly split 8-byte writes into separate 32-bit WRITE_ONCE() operations (commit references: git.kernel.org/stable/c/4bdc94d45d5459f0149085dfc1efe733c8e14f11 and related commits). Until patching is possible, disable Clang LTO compilation (set CONFIG_LTO=n) if rebuilding the kernel locally, or avoid triggering multipath routing hash operations by disabling ECMP routing if not required. System administrators should prioritize patching for ARM64 deployments that use Clang-compiled kernels and rely on multipath routing, as the fix is straightforward and available upstream.

Affected VersionsENISA

Linux patch: 6.18.17

Linux 6.11

Linux patch: 6.12.77

Linux patch: 7.0-rc3

Linux 4ee2a8cace3fb9a34aea6a56426f89d26dd514f3 <4ee7fa6cf78ff26d783d39e2949d14c4c1cd5e7f

Linux patch: 0

Linux patch: 6.19.7

Linux 4ee2a8cace3fb9a34aea6a56426f89d26dd514f3 <7e4ad34a8889a6a9e0f6cc7c55d02161fe31a199

Linux 4ee2a8cace3fb9a34aea6a56426f89d26dd514f3 <607e923a3c1b2120de430b3dcde25ed8ad213c0a

Linux 4ee2a8cace3fb9a34aea6a56426f89d26dd514f3 <4bdc94d45d5459f0149085dfc1efe733c8e14f11

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in the Linux kernel's IPv4 multipath routing implementation (CPE: cpe:2.3:a:linux:linux), specifically in how the sysctl_fib_multipath_hash_seed structure—containing two 32-bit u32 fields (user_seed and mp_seed)—is accessed via READ_ONCE() and WRITE_ONCE() macros. The root cause involves unsafe use of atomic read/write operations on an 8-byte structure with only 4-byte alignment. When compiled with Clang and LTO, the compiler emits ARM64 Load-Acquire (ldar) and Store-Release (stlr) instructions that require strict 64-bit natural alignment. The ARM64 ISA strictly enforces alignment for these instructions, triggering an Alignment Fault (FSC = 0x21) when the 8-byte ldar instruction attempts to execute on a 4-byte aligned address. Additionally, the 8-byte WRITE_ONCE() operation can be split into two separate 32-bit stores by Clang, destroying atomicity and creating a tear-write vulnerability where partial updates expose inconsistent state during concurrent reads. The proper fix involves moving READ_ONCE() to individual 32-bit fields and explicitly splitting writes into two separate 32-bit WRITE_ONCE() operations to maintain both correctness and architectural compliance.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SUSE MEDIUM

Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 21:27 NVD

5.5 (MEDIUM)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 25, 2026 - 10:27 nvd

N/A

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: ipv4: fix ARM64 alignment fault in multipath hash seed

struct sysctl_fib_multipath_hash_seed contains two u32 fields (user_seed and mp_seed), making it an 8-byte structure with a 4-byte alignment requirement.

In fib_multipath_hash_from_keys(), the code evaluates the entire struct atomically via READ_ONCE():

mp_seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed).mp_seed;

While this silently works on GCC by falling back to unaligned regular loads which the ARM64 kernel tolerates, it causes a fatal kernel panic when compiled with Clang and LTO enabled.

Commit e35123d83ee3 ("arm64: lto: Strengthen READ_ONCE() to acquire when CONFIG_LTO=y") strengthens READ_ONCE() to use Load-Acquire instructions (ldar / ldapr) to prevent compiler reordering bugs under Clang LTO. Since the macro evaluates the full 8-byte struct, Clang emits a 64-bit ldar instruction. ARM64 architecture strictly requires ldar to be naturally aligned, thus executing it on a 4-byte aligned address triggers a strict Alignment Fault (FSC = 0x21).

Fix the read side by moving the READ_ONCE() directly to the u32 member, which emits a safe 32-bit ldar Wn.

Furthermore, Eric Dumazet pointed out that WRITE_ONCE() on the entire struct in proc_fib_multipath_hash_set_seed() is also flawed. Analysis shows that Clang splits this 8-byte write into two separate 32-bit str instructions. While this avoids an alignment fault, it destroys atomicity and exposes a tear-write vulnerability. Fix this by explicitly splitting the write into two 32-bit WRITE_ONCE() operations.

Finally, add the missing READ_ONCE() when reading user_seed in proc_fib_multipath_hash_seed() to ensure proper pairing and concurrency safety.

Threat Intelligence Overview

EPSS Score

0.0%

Top 96% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +28

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Linux Kernel Multiple Vulnerabilities

View all 4

CVE-2026-23372 HIGH

7.8

CVE-2026-23371 MEDIUM

5.5

CVE-2026-23346 MEDIUM

5.5

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

Debian

linux

Release	Status	Fixed Version	Urgency
bullseye	not-affected	-	-
bullseye (security)	fixed	5.10.251-1	-
bookworm	not-affected	-	-
bookworm (security)	fixed	6.1.164-1	-
trixie	vulnerable	6.12.73-1	-
trixie (security)	vulnerable	6.12.74-2	-
forky, sid	fixed	6.19.8-1	-
(unstable)	fixed	6.19.8-1	-

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-23316 ADVISORY https://vuldb.com/?id.353014 REF https://git.kernel.org/stable/c/4bdc94d45d5459f0149085dfc1efe733c8e14f11 REF https://git.kernel.org/stable/c/4ee7fa6cf78ff26d783d39e2949d14c4c1cd5e7f REF https://git.kernel.org/stable/c/607e923a3c1b2120de430b3dcde25ed8ad213c0a REF https://git.kernel.org/stable/c/7e4ad34a8889a6a9e0f6cc7c55d02161fe31a199

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back