LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-time

## Summary On targets that do not have a conditional move/select operations, LLVM compiles the internal `conditional_sub_u32()` function, into one that will contain a conditional jump on secret-dependent data, which could leak information about encapsulation and signing keys. `conditional_sub_u32()` is used throughout the field arithmetic of both ML-KEM and ML-DSA. ## Impact The variable-time jumps have been observed for ML-KEM and ML-DSA on: - `i586-unknown-linux-gnu` - `s390x-unknown-linux-gnu` Additionally, ML-DSA sees the vulnerable LLVM optimization on `x86_64-unknown-linux-gnu`, for `hazardous::dsa::mldsa44` and `hazardous::dsa::mldsa87`. The leakage this LLVM optimization introduces could enable recovery of cryptographic secrets. The practicality of exploiting the leakage depends on the compiler, target CPU used and how "close" to the process using the vulnerable functions the attacker is. ## Resolution Upgrade to `v0.17.16` or `v0.18.1`. `conditional_sub_u32()` has been re-written to take conditional-move/jump ops availability into account.

Source published

30 Oct 2026 12:00:00 UTC

Source modified

30 Oct 2026 11:15:02 UTC

Observed here

30 Oct 2026 11:49:33 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.