CVE-2026-53346: Linux Kernel ARM64 Boot Failure with Rust Unwinding Tables

Technical summary

CVE-2026-53346 involves a rustc bug affecting ARM64 Linux kernel builds with CONFIG_UNWIND_TABLES enabled. The -Cforce-unwind-tables=y compiler flag fails to emit the uwtable annotation for compiler-generated functions like 'asan.module_ctor'. When CONFIG_UNWIND_PATCH_PAC_INTO_SCS is active, the SCS (Shadow Call Stack) boot-time patching code relies on accurate DWARF unwinding information. Missing uwtable annotations cause the patching logic to asymmetrically apply PAC (Pointer Authentication Code) instructions—specifically, paciasp is patched but autiasp is not. This mismatch violates ARM64 PAC semantics and triggers a fault when the constructor executes during do_ctors() in init/main.c. The vulnerability is classified as CWE-125 (Out-of-bounds Read) because the incorrect DWARF data leads to memory access violations. The fix has landed in Rust 1.98.0 (expected 2026-08-20); kernel maintainers have added version checks to conditionally apply the workaround flag only on affected rustc versions.

Business impact

Systems running Linux kernel builds compiled with Rust support, KASAN enabled, and PAC-into-SCS patching active will experience boot failures, effectively rendering the system unusable until the kernel is rebuilt or upgraded. This affects embedded systems, cloud infrastructure, and edge deployments that rely on these security hardening features. The HIGH severity reflects the denial-of-service impact: affected systems cannot boot, not a runtime memory safety failure that might be exploitable from user space. Organizations using Rust-based kernel builds for security-critical deployments should prioritize updates.

Affected systems

Linux kernel versions built with Rust support (requires CONFIG_RUST=y) and ARM64 architecture, specifically when both CONFIG_UNWIND_TABLES and CONFIG_UNWIND_PATCH_PAC_INTO_SCS are enabled. The vulnerability manifests only at boot time, so it affects systems attempting to start with such configurations. Older rustc versions prior to the fix landing in 1.98.0 are affected; note that the kernel can ship workaround flags that have no effect on already-fixed rustc versions, ensuring forward compatibility.

Exploitability

This vulnerability cannot be exploited by an attacker to gain unauthorized access or escalate privileges; it is a build-time and boot-time issue that prevents the system from starting rather than creating a runtime security gap. No CVE entry exists in the KEV catalog (actively exploited vulnerabilities), and no public exploit code exists because the mechanism is deterministic kernel initialization failure rather than a memory corruption primitive. However, the issue is 'trivially reproducible'—any attempt to boot a kernel with the affected configuration combination will crash, making it easy to detect if present and causing immediate operational impact.

Remediation

Apply kernel updates that include the fix, which conditionally applies the llvm uwtable module flag only when compiling with rustc versions prior to 1.98.0. Alternatively, disable CONFIG_UNWIND_PATCH_PAC_INTO_SCS or CONFIG_UNWIND_TABLES at compile time as a workaround if kernel updates are delayed. Upgrade rustc to version 1.98.0 or later when available (expected 2026-08-20), which resolves the underlying compiler bug and eliminates the need for the kernel-side workaround.

Patch guidance

Verify that your Linux kernel build includes the conditional uwtable flag fix by checking kernel commit history or release notes. If building your own kernel, ensure you are using rustc 1.98.0 or later, or apply the fix to conditionally enable -Cforce-unwind-tables=y for rustc versions before 1.98.0. Test your build on ARM64 hardware to confirm successful boot with CONFIG_UNWIND_PATCH_PAC_INTO_SCS enabled. Consult your distribution (Fedora, Ubuntu, Arch) or SoC vendor's kernel releases for backported patches if you cannot upgrade rustc immediately.

Detection guidance

If your system fails to boot with a fault in do_ctors() or references to asan.module_ctor in kernel logs, check your kernel config (cat /boot/config-$(uname -r)) for CONFIG_RUST=y, CONFIG_UNWIND_TABLES=y, and CONFIG_UNWIND_PATCH_PAC_INTO_SCS=y. Confirm the rustc version used to build the kernel (rustc --version) is prior to 1.98.0. Boot failure logs will show 'KASAN: global-out-of-bounds' or similar memory fault messages. This detection is passive (boot failure is the indicator) rather than requiring active scanning.

Why prioritize this

Although the CVSS score is 7.1 (HIGH), this is a boot-time denial-of-service rather than an exploitable memory corruption. Prioritize based on deployment: (1) If you run ARM64 systems with Rust kernel support and PAC-into-SCS hardening, this is a critical blocker—update immediately. (2) If you use standard distributions without Rust kernel modules, risk is minimal. (3) If you manually compile kernels, verify rustc version before building. The vulnerability does not create a window for privilege escalation or data theft but does prevent system operation, so SLAs for system availability should drive urgency.

Risk score, explained

The CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H yields a score of 7.1 (HIGH). Attack Vector (Local) and Access Complexity (Low) reflect that the issue triggers on boot without network or user interaction. The requirement for local privilege level (PR:L) accounts for the need to compile and deploy a kernel, which typically requires administrative access. Confidentiality (High) and Availability (High) impact ratings likely stem from the broad potential of unwind table corruption; however, in this specific vulnerability, the impact manifests solely as boot failure (Availability), not information disclosure. The scope is Unchanged (local system only). The score appropriately reflects high operational severity, though the practical threat model is narrower than a typical HIGH-scored memory corruption bug.

Frequently asked questions