AIKIDO-2026-577666

TL;DR

Mbed TLS detects processor support for the AESNI and CLMUL instructions in mbedtls_aesni_has_support() and caches the result in global variables. Depending on compiler optimizations, the flag marking the cache as populated can be written before the cached value itself, creating a race where a second thread reads the default value and falls back to the table-based AES and GCM implementations. Those portable implementations are not constant time, so a local attacker who can observe memory access patterns and stall a thread can recover AES keys or forge GCM tags. The fix orders the writes so concurrent callers always observe a fully populated detection result.