kcov: fix data corruption and race conditions on PREEMPT_RT
In the Linux kernel, the following vulnerability has been resolved: kcov: fix data corruption and race conditions on PREEMPT_RT syzbot is reporting KCOV state corruption on PREEMPT_RT kernels, for the temporary storage used for saving/restoring remote KCOV state is currently allocated as the per-CPU area. On PREEMPT_RT kernels, softirq handlers run as preemptible task threads (e.g., ksoftirqd). If a softirq context preempts a task running a remote KCOV session, it safely saves the task's state into the per-CPU area. However, if that softirq thread is subsequently preempted by a higher- priority softirq thread on the same CPU, the second softirq will overwrite the same per-CPU area, permanently destroying the original task's KCOV state. Fix this data corruption by moving the temporary storage from the per-CPU area to the per-thread area. Since each softirq thread now owns its own task context, nested softirq preemption no longer causes data overwrites. Note that while the temporary storage is now on a per-thread basis, the per-CPU kcov_percpu_data.lock must be retained, for we need to ensure that kcov_remote_start() and kcov_remote_stop() operate atomically without racing against asynchronous interrupts that manipulate the current task's KCOV state. It is likely that GFP_KERNEL allocation by vmalloc_node() in kcov_init() has already called panic() before returning NULL, for there will be no OOM-killable userspace processes when __init function of built-in module runs. But this
CVE-2026-80916
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-80916
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
"lessThan": "ef7048d8a614c5f5a9b20513a5428101a744514e",
"versionType": "git"
},
{
"status": "affected",
"version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
"lessThan": "8ed3ddf23d39bf5338406bd9f8863d44748cf6ce",
"versionType": "git"
},
{
"status": "affected",
"version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
"lessThan": "5dc59fc959b2b5742985d7ef24bccd1868217dc2",
"versionType": "git"
},
{
"status": "affected",
"version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
"lessThan": "a2fb8222cde23b0001812ed3acb7c0ea36dd94e2",
"versionType": "git"
},
{
"status": "affected",
"version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
"lessThan": "18799e858b407bf355383c9dd6c06477aa437134",
"versionType": "git"
},
{
"status": "affected",
"version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
"lessThan": "e11f5b48c82703242a3be7a7ae4b4940b4cb4610",
"versionType": "git"
},
{
"status": "affected",
"version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
"lessThan": "22670d1552fe155822b2abf91f920925f7d067b4",
"versionType": "git"
},
{
"status": "affected",
"version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
"lessThan": "f8c9a3ec36b4ee3d4701b9be08f40e7bfbf89761",
"versionType": "git"
},
{
"status": "affected",
"version": "5ff3b30ab57da82d8db4f14662a2858cabfbc2c0",
"lessThan": "2eed77fdcb0cc48e8eccb2bcd4b7f2c6d650e84c",
"versionType": "git"
}
],
"programFiles": [
"include/linux/sched.h",
"kernel/kcov.c",
"lib/Kconfig.debug"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.8",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.269",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.220",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.47",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.11",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2.1",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"include/linux/sched.h",
"kernel/kcov.c",
"lib/Kconfig.debug"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-80916
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #34879 · Revision 1
- Added to Heist Feed
- Publisher date