Executive brief
A vulnerability in the Linux kernel's x86_64 architecture can cause a system to crash in an endless loop when performing a kernel reboot (kexec) on systems configured with specific debugging features. This issue primarily affects developers and security researchers using coverage-guided fuzzing tools like syzkaller. While it does not directly expose data, it can lead to a complete denial of service by preventing the system from successfully transitioning to a new kernel or collecting crash dumps.
Technical details
A flaw exists in the x86_64 kexec implementation where the load_segments() function invalidates the GS base register. Because the Kernel Code Coverage (KCOV) feature relies on the GS base to access per-CPU data, any subsequent instrumented C code calls (such as native_gdt_invalidate) trigger a kernel crash. On systems where both CONFIG_KCOV and CONFIG_KEXEC are enabled, this results in an endless recursive crash loop during the kexec execution phase. The vulnerability is specific to 64-bit kernels as KCOV is not supported on 32-bit x86. The fix involves disabling KCOV instrumentation for machine_kexec_64.c and physaddr.c to prevent these invalid accesses during the transition.
Affected products
- Linux Linux kernel x86_64 kernels with CONFIG_KCOV and CONFIG_KEXEC enabled
Timeline
- 2026-03-25: other: Patch authored by Aleksandr Nogikh
- 2026-05-08: disclosed: CVE published
- 2026-05-08: advisory: NVD entry created