The Linux kernel’s kexec mechanism does not account for the register changes performed by load_segments() when the kernel is built with KCOV instrumentation support. The load_segments() function modifies the GS base register, which KCOV relies on for per‑CPU data. After this change, subsequent instrumented calls such as native_gdt_invalidate() crash the kernel and enter an endless loop. An attacker can exploit this by executing kexec to load a KCOV‑instrumented kernel, leading to an immediate denial of service by rendering the system unresponsive.

Linux kernel components that enable both CONFIG_KCOV and CONFIG_KEXEC (primarily 64‑bit builds). The flaw does not affect 32‑bit kernels because KCOV is not supported there.

The vulnerability is of high severity because any user with the capability to execute kexec—typically a privileged or root user—can trigger a kernel crash. EPSS information is not available, and the flaw is not listed in the CISA KEV catalog. The attack vector is local and requires the ability to run kexec commands. Once triggered, the kernel will repeatedly crash, requiring a reboot to recover, thereby disrupting availability for all services running on the affected machine.