LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-time

Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

The orion crate versions before 0.17.16 and from 0.18.0 up to (not including) 0.18.1 are affected. On certain targets, such as i586 and s390x Linux and some x86_64 ML-DSA builds, LLVM can compile a helper function used in ML-KEM and ML-DSA arithmetic into a conditional jump depending on secret data. An attacker with the ability to observe timing could potentially recover cryptographic secrets, and exploitability depends on the compiler, target CPU, and attacker proximity. Upgrade to orion 0.17.16 or 0.18.1.

Written 3 Nov 2026.