RUSTSEC-2026-0426 LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-time

Summary On targets that do not have a conditional move/select operations, LLVM compiles the internal conditionalsubu32 function, into one that will contain a conditional jump on secret-dependent data, which could leak information about encapsulation and signing keys. conditionalsubu32 is used...

LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-time

Summary On targets that do not have a conditional move/select operations, LLVM compiles the internal conditionalsubu32 function, into one that will contain a conditional jump on secret-dependent data, which could leak information about encapsulation and signing keys. conditionalsubu32 is used...