GHSA-r7wm-4vf2-h44w
LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-time
GHSA-r7wm-4vf2-h44w is a vulnerability with no CVSS score yet in orion, published October 30, 2026. No source lists public exploit code. Fixed in orion 0.17.16.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.17.16orion
Description
Summary
On targets that do not have a conditional move/select operations, LLVM compiles the internal conditional_sub_u32() function, into one that will contain a conditional jump on secret-dependent data, which could leak information about encapsulation and signing keys.
conditional_sub_u32() is used throughout the field arithmetic of both ML-KEM and ML-DSA.
Impact
The variable-time jumps have been observed for ML-KEM and ML-DSA on:
i586-unknown-linux-gnus390x-unknown-linux-gnu
Additionally, ML-DSA sees the vulnerable LLVM optimization on x86_64-unknown-linux-gnu, for hazardous::dsa::mldsa44 and hazardous::dsa::mldsa87.
The leakage this LLVM optimization introduces could enable recovery of cryptographic secrets. The practicality of exploiting the leakage depends on the compiler, target CPU used and how "close" to the process using the vulnerable functions the attacker is.
Resolution
Upgrade to v0.17.16 or v0.18.1. conditional_sub_u32() has been re-written to take conditional-move/jump ops availability into account.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
orioncrates.io | 0.0.0-0 up to 0.17.16, 0.18.0-0 up to 0.18.1 | 0.17.160.18.1 |
What each source reports
OSVRUSTSEC-2026-0426No score
LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-time
Summary
On targets that do not have a conditional move/select operations, LLVM compiles the internal conditional_sub_u32() function, into one that will contain a conditional jump on secret-dependent data, which could leak information about encapsulation and signing keys.
conditional_sub_u32() is used throughout the field arithmetic of both ML-KEM and ML-DSA.
Impact
The variable-time jumps have been observed for ML-KEM and ML-DSA on:
i586-unknown-linux-gnus390x-unknown-linux-gnu
Additionally, ML-DSA sees the vulnerable LLVM optimization on x86_64-unknown-linux-gnu, for hazardous::dsa::mldsa44 and hazardous::dsa::mldsa87.
The leakage this LLVM optimization introduces could enable recovery of cryptographic secrets. The practicality of exploiting the leakage depends on the compiler, target CPU used and how "close" to the process using the vulnerable functions the attacker is.
Resolution
Upgrade to v0.17.16 or v0.18.1. conditional_sub_u32() has been re-written to take conditional-move/jump ops availability into account.
- Record
RUSTSEC-2026-0426- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.