Description
RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the aarch64 implementations of Cmov and CmovEq in cmov/src/backends/aarch64.rs assume high bits are zero-extended when loading values smaller than a register, so set high bits such as [8..] in a Cmov selector or [16..] of self or other in the u16 and i16 CmovEq implementations can cause left.cmovz(&right, condition) to produce incorrect output. This issue is fixed in version 0.5.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| RustCrypto | utils | >= 0.1.1, < 0.5.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-cmov | 0.5.4-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-cmov | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | rust +18 | 1.97.1-1.1.hum1 | RHSA-2026:42923 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | amazon-efs-utils | 3.3.2-1.amzn2023 | ALAS2023-2026-3132 |
| Amazon Linux 2023 | rust +14 | 1.97.0-2.amzn2023 | ALAS2023-2026-2065 |
| Amazon Linux 2 | amazon-efs-utils | 3.3.2-1.amzn2 | ALAS2-2026-3948 |
| Amazon Linux 2 | rust +11 | 1.97.0-2.amzn2 | ALAS2-2026-3865 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | deno | 2.9.1-r1 | — |
| Wolfi rolling | mountpoint-s3 | 1.22.3-r5 | — |
| Wolfi rolling | pixi | 0.72.0-r1 | — |
| Wolfi rolling | yazi | 26.5.6-r5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | cmov | >= 0.1.1, < 0.5.4 | 0.5.4 | GHSA-3rjw-m598-pq24 |
Advisories 5
- RHSA-2026:42923 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- ALAS2023-2026-3132 Low: amazon-efs-utils security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 28, 2026
- ALAS2-2026-3948 Low: amazon-efs-utils security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 28, 2026
- ALAS2-2026-3865 Important: rust security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 17, 2026
- ALAS2023-2026-2065 Important: rust security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 17, 2026