Executive brief
A vulnerability in the Linux kernel's support for the Rust programming language on ARM64 systems can lead to system crashes during the boot process. This issue occurs when specific security features are enabled, causing the system to incorrectly patch internal code instructions. While this primarily affects system stability and availability, it could prevent a server or device from starting up correctly.
Technical details
The vulnerability stems from a bug in the Rust compiler (rustc) where the -Cforce-unwind-tables=y flag fails to emit the 'uwtable' annotation for the entire module, specifically affecting compiler-generated functions like 'asan.module_ctor'. On arm64 systems with CONFIG_UNWIND_PATCH_PAC_INTO_SCS enabled, this results in incorrect DWARF information. Consequently, the Shadow Call Stack (SCS) boot patching code incorrectly patches instructions (e.g., patching 'paciasp' but not 'autiasp'), leading to a kernel crash during boot when constructors are invoked. The fix involves manually setting the 'uwtable' LLVM module flag in the arm64 Makefile for affected rustc versions (prior to 1.98.0).
Affected products
- Linux Linux Kernel 6.12.x and earlier versions using Rust on arm64
Timeline
- 2026-05-27: disclosed: Initial patch submitted by Alice Ryhl
- 2026-06-19: patched: Patch committed to stable kernel trees
- 2026-07-01: advisory: CVE-2026-53346 published