CVE-2026-23316

In the Linux kernel, the following vulnerability has been resolved:

net: ipv4: fix ARM64 alignment fault in multipath hash seed

`struct sysctl_fib_multipath_hash_seed` contains two u32 fields

(user_seed and mp_seed), making it an 8-byte structure with a 4-byte

alignment requirement.

In `fib_multipath_hash_from_keys()`, the code evaluates the entire

struct atomically via `READ_ONCE()`:

mp_seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed).mp_seed;

While this silently works on GCC by falling back to unaligned regular

loads which the ARM64 kernel tolerates, it causes a fatal kernel panic

when compiled with Clang and LTO enabled.

Commit e35123d83ee3 ("arm64: lto: Strengthen READ_ONCE() to acquire

when CONFIG_LTO=y") strengthens `READ_ONCE()` to use Load-Acquire

instructions (`ldar` / `ldapr`) to prevent compiler reordering bugs

under Clang LTO. Since the macro evaluates the full 8-byte struct,

Clang emits a 64-bit `ldar` instruction. ARM64 architecture strictly

requires `ldar` to be naturally aligned, thus executing it on a 4-byte

aligned address triggers a strict Alignment Fault (FSC = 0x21).

Fix the read side by moving the `READ_ONCE()` directly to the `u32`

member, which emits a safe 32-bit `ldar Wn`.

Furthermore, Eric Dumazet pointed out that `WRITE_ONCE()` on the entire

struct in `proc_fib_multipath_hash_set_seed()` is also flawed. Analysis

shows that Clang splits this 8-byte write into two separate 32-bit

`str` instructions. While this avoids an alignment fault, it destroys

atomicity and exposes a tear-write vulnerability. Fix this by

explicitly splitting the write into two 32-bit `WRITE_ONCE()`

operations.

Finally, add the missing `READ_ONCE()` when reading `user_seed` in

`proc_fib_multipath_hash_seed()` to ensure proper pairing and

concurrency safety.