The vulnerability arises from GCC's GCOV instrumentation, which merges global counter values with loop induction variables in the inflate_fast() routine. When multiple CPUs execute this code concurrently, the global GCOV counter may change between loads, yielding inconsistent base, start, and end values for a loop. This inconsistency causes an out‑of‑bounds write that overwrites memory beyond a 65 KB buffer, as demonstrated by the crash trace. The fault is a classic out‑of‑bounds write (CWE‑787) that can corrupt kernel memory and potentially lead to a kernel panic or arbitrary code execution if an attacker can influence the decompression path.

Any Linux kernel build with GCOV instrumentation enabled (CONFIG_GCOV_KERNEL and related options) and the IP Payload Compression (IPComp) subsystem activated is vulnerable. The issue manifests during concurrent inflate_fast() execution on multi‑CPU systems, so deployments that disable GCOV or compile the kernel without IPComp do not experience the flaw. The exact versions are not listed; the vulnerability applies to all affected Linux kernel configurations containing the described code paths.

The CVSS score of 9.8 indicates a high‑severity flaw, yet the EPSS is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, which together suggest a low probability of immediate exploitation. Exploitation requires IPComp to be enabled and for an attacker to provoke the kernel to traverse the inflate_fast() routine, most likely through specially crafted network packets. The likely attack vector is local or remote network access to a system offering IPComp, but the practical attack surface is narrow. Consequently, while the risk remains serious due to the memory corruption capability, the low EPSS indicates limited active exploitation likely in the near future.