CVE-2026-43331

x86/kexec: Disable KCOV instrumentation after load_segments()

Published May 8, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

x86/kexec: Disable KCOV instrumentation after load_segments()

The load_segments() function changes segment registers, invalidating GS base
(which KCOV relies on for per-cpu data). When CONFIG_KCOV is enabled, any
subsequent instrumented C code call (e.g. native_gdt_invalidate()) begins
crashing the kernel in an endless loop.

To reproduce the problem, it's sufficient to do kexec on a KCOV-instrumented
kernel:

$ kexec -l /boot/otherKernel
$ kexec -e

The real-world context for this problem is enabling crash dump collection in
syzkaller. For this, the tool loads a panic kernel before fuzzing and then
calls makedumpfile after the panic. This workflow requires both CONFIG_KEXEC
and CONFIG_KCOV to be enabled simultaneously.

Adding safeguards directly to the KCOV fast-path (__sanitizer_cov_trace_pc())
is also undesirable as it would introduce an extra performance overhead.

Disabling instrumentation for the individual functions would be too fragile,
so disable KCOV instrumentation for the entire machine_kexec_64.c and
physaddr.c. If coverage-guided fuzzing ever needs these components in the
future, other approaches should be considered.

The problem is not relevant for 32 bit kernels as CONFIG_KCOV is not supported
there.

[ bp: Space out comment for better readability. ]

Analysis

Technical impact

The Linux kernel’s kexec mechanism does not account for the register changes performed by load_segments() when the kernel is built with KCOV instrumentation support. The load_segments() function modifies the GS base register, which KCOV relies on for per‑CPU data. After this change, subsequent instrumented calls such as native_gdt_invalidate() crash the kernel and enter an endless loop. The NVD entry does not map this vulnerability to a specific CWE, but it can be exploited by executing kexec to load a KCOV‑instrumented kernel, leading to an immediate denial of service by rendering the system unresponsive.

Affected Systems

Linux kernel components that enable both CONFIG_KCOV and CONFIG_KEXEC (primarily 64‑bit builds) are affected. The flaw does not affect 32‑bit kernels because KCOV is not supported there. Affected versions explicitly include Linux kernel 7.0 release candidates rc1 through rc6 and, based on the description, it is inferred that any subsequent stable releases that also enable both options would be affected.

Risk and Exploitability

The CVSS score of 5.5 indicates a medium severity. EPSS score is < 1% and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is local and requires the ability to run kexec commands. Once triggered, the kernel will repeatedly crash, requiring a reboot to recover, thereby disrupting availability for all services running on the affected machine.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0d345996e4cb573f8cc81d49b3ee9a7fd2035bef`	affected	< 0e96cd314c0d819c1635d68125a4d77852c2162e
`0d345996e4cb573f8cc81d49b3ee9a7fd2035bef`	affected	< 593d67032544b9271094fc9b43e437e017cb2b2f
`0d345996e4cb573f8cc81d49b3ee9a7fd2035bef`	affected	< 1e3e98596c2769721ade0418434852fb3af4849a
`0d345996e4cb573f8cc81d49b3ee9a7fd2035bef`	affected	< de05c66fab8847237a9ca216934e56d3ee837f08
`0d345996e4cb573f8cc81d49b3ee9a7fd2035bef`	affected	< 917e3ad3321e75ca0223d5ccf26ceda116aa51e1

Linux

affected

Version	Status	Constraints
`6.6`	affected	—
`0`	unaffected	< 6.6
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.22`	unaffected	≤ 6.18.*
`6.19.12`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[0d345996e4cb573f8cc81d49b3ee9a7fd2035bef,1e3e98596c2769721ade0418434852fb3af4849a)`	affected	code_commit	—
`[0d345996e4cb573f8cc81d49b3ee9a7fd2035bef,de05c66fab8847237a9ca216934e56d3ee837f08)`	affected	code_commit	—
`[0d345996e4cb573f8cc81d49b3ee9a7fd2035bef,917e3ad3321e75ca0223d5ccf26ceda116aa51e1)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.6`	affected	semver	—
`[0,6.6)`	unaffected	semver	—
`[6.18.22,6.19.0)`	unaffected	semver	—
`[6.19.12,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch series that disables KCOV instrumentation in machine_kexec_64.c and physaddr.c (for example, the commits referenced at https://git.kernel.org/stable/c/1e3e98596c2769721ade0418434852fb3af4849a and its successors).
Rebuild and install the patched kernel so that the changes take effect.
If KCOV must remain enabled for other operations, temporarily disable KCOV or rebuild the kernel with CONFIG_KCOV disabled before performing a kexec operation.

Generated by OpenCVE AI on May 18, 2026 at 16:24 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6355-1	linux security update
Ubuntu USN	USN-8903-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8904-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8905-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8906-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8903-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8905-2	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.122% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43331.mbox
https://git.kernel.org/stable/c/0e96cd314c0d819c1635d68125a4d77852c2162e
https://git.kernel.org/stable/c/1e3e98596c2769721ade0418434852fb3af4849a
https://git.kernel.org/stable/c/593d67032544b9271094fc9b43e437e017cb2b2f
https://git.kernel.org/stable/c/917e3ad3321e75ca0223d5ccf26ceda116aa51e1
https://git.kernel.org/stable/c/de05c66fab8847237a9ca216934e56d3ee837f08
https://nvd.nist.gov/vuln/detail/CVE-2026-43331
https://www.cve.org/CVERecord?id=CVE-2026-43331

History

Jun 19, 2026 12:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0e96cd314c0d819c1635d68125a4d77852c2162e

Jun 9, 2026 11:15 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/593d67032544b9271094fc9b43e437e017cb2b2f

May 18, 2026 2:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-535

May 18, 2026 12:45 PM Weaknesses updated. Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

May 16, 2026 12:15 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43331.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-43331 https://www.cve.org/CVERecord?id=CVE-2026-43331

May 8, 2026 7:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-535

May 8, 2026 2:00 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Disable KCOV instrumentation after load_segments() The load_segments() function changes segment registers, invalidating GS base (which KCOV relies on for per-cpu data). When CONFIG_KCOV is enabled, any subsequent instrumented C code call (e.g. native_gdt_invalidate()) begins crashing the kernel in an endless loop. To reproduce the problem, it's sufficient to do kexec on a KCOV-instrumented kernel: $ kexec -l /boot/otherKernel $ kexec -e The real-world context for this problem is enabling crash dump collection in syzkaller. For this, the tool loads a panic kernel before fuzzing and then calls makedumpfile after the panic. This workflow requires both CONFIG_KEXEC and CONFIG_KCOV to be enabled simultaneously. Adding safeguards directly to the KCOV fast-path (__sanitizer_cov_trace_pc()) is also undesirable as it would introduce an extra performance overhead. Disabling instrumentation for the individual functions would be too fragile, so disable KCOV instrumentation for the entire machine_kexec_64.c and physaddr.c. If coverage-guided fuzzing ever needs these components in the future, other approaches should be considered. The problem is not relevant for 32 bit kernels as CONFIG_KCOV is not supported there. [ bp: Space out comment for better readability. ]
Title		x86/kexec: Disable KCOV instrumentation after load_segments()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1e3e98596c2769721ade0418434852fb3af4849a https://git.kernel.org/stable/c/917e3ad3321e75ca0223d5ccf26ceda116aa51e1 https://git.kernel.org/stable/c/de05c66fab8847237a9ca216934e56d3ee837f08