CVE-2026-53343: Linux ARM Kernel Alignment Fault in __switch_to() with KASAN VMALLOC

Technical summary

CVE-2026-53343 involves an unaligned memory access in the ARM __switch_to() function introduced by commit 44e9a3bb76e5. That commit added a dummy read from KASAN VMAP stack shadow space to fault in shadow mappings. The code uses an ldr (load register) instruction, which performs a 32-bit word load and requires 4-byte alignment. KASAN shadow memory is byte-granular and the shadow address is not guaranteed to be word-aligned. On ARMv5 processors (e.g., ARM926 with VersatilePB), unaligned word loads trigger data abort exceptions. With both CONFIG_KASAN_VMALLOC and CONFIG_VMAP_STACK enabled, this causes a crash during context switch before the kernel initializes user space. The resolution changes ldr to ldrb (load register byte), which respects byte granularity and prevents the alignment fault.

Business impact

This vulnerability affects systems running Linux on older ARM processors with KASAN and VMAP stack protection compiled in. Impacted deployments experience system unavailability—the kernel crashes during early boot, preventing the system from reaching a usable state. For embedded and IoT devices using ARM926 or similar processors with these kernel configurations, this becomes a critical availability issue. Organizations cannot run affected kernel versions on these architectures without workarounds. The fix is minimal and low-risk, so patching is straightforward once identified.

Affected systems

The vulnerability affects the Linux kernel across multiple versions where the problematic commit (44e9a3bb76e5) is present. It manifests specifically on ARMv5-compatible processors (including ARM926 and compatible cores) when both CONFIG_KASAN_VMALLOC and CONFIG_VMAP_STACK kernel configuration options are enabled. Systems without these configurations enabled, or running on ARM architectures that permit unaligned word loads (ARMv6 and later), are not affected. The issue is architecture and configuration-specific, making it primarily relevant to embedded Linux systems and custom ARM kernel builds.

Exploitability

This is not exploitable by external attackers. It is a reliability flaw triggered deterministically during kernel initialization when specific configurations are present. The crash occurs during the context switch in __switch_to(), which is called before user space starts. No privilege escalation, data exfiltration, or other attack vector exists. The vulnerability manifests only as a denial of service in the form of boot failure for affected configurations. It affects system stability rather than security posture.

Remediation

Apply a kernel patch that replaces the ldr instruction with ldrb in the ARM __switch_to() shadow access code. This single-instruction change aligns the memory access with KASAN's byte-granular shadow memory model and eliminates the alignment fault. Verify that your kernel version includes the fix commit (expected to land in the stable and mainline trees post-publication). For systems currently affected, either disable one of the two configurations (CONFIG_KASAN_VMALLOC or CONFIG_VMAP_STACK), upgrade to a patched kernel version, or build with a version that predates the problematic commit 44e9a3bb76e5.

Patch guidance

Apply the patch that changes the KASAN VMAP stack shadow access from ldr (word load) to ldrb (byte load) in the ARM entry code. This fix should be verified against the official Linux kernel tree and Linux distribution advisories. The patch is minimal (one instruction change) and low-risk. After applying, rebuild the kernel with both CONFIG_KASAN_VMALLOC and CONFIG_VMAP_STACK enabled and test on ARM926 or compatible hardware to confirm boot success. Check your Linux distribution or kernel.org for availability in stable branch updates.

Detection guidance

Detection is primarily post-incident: if an ARM-based system with CONFIG_KASAN_VMALLOC and CONFIG_VMAP_STACK enabled fails to boot with an alignment exception in __switch_to() or related context-switch code, this vulnerability is the likely cause. Review kernel logs (if available via serial console or previous boots) for 'Alignment fault' or 'Data abort' messages pointing to __switch_to(). Proactively audit your ARM kernel builds: check the .config file for both KASAN_VMALLOC and VMAP_STACK settings and the kernel version against the affected range. Build systems should test configurations on target hardware before deployment.

Why prioritize this

This vulnerability rates as medium priority for affected organizations. While the CVSS score reflects local access and availability impact (5.5), the practical priority depends on your deployment: organizations using ARM926-class processors with both KASAN_VMALLOC and VMAP_STACK enabled face boot failures and should patch immediately. Organizations using modern ARM (ARMv6+), x86, or other architectures, or those without these specific kernel configurations, can deprioritize but should still track the fix to ensure future kernel updates don't reintroduce similar issues. The fix is simple and carries low regression risk.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) reflects the availability impact (denial of service via boot failure) combined with local-only attack surface and no privilege escalation. The score does not account for the narrow affected population (older ARM processors with specific kernel configurations). For those few affected systems, the real-world impact is severe (complete unavailability). For the broader Linux install base, the risk is negligible. Prioritize based on whether you operate the specific hardware and kernel configurations mentioned.

Frequently asked questions