Executive brief
A vulnerability in the Linux kernel's code coverage tool (GCOV) can cause system crashes or memory corruption when multiple processors access the same data simultaneously. This issue occurs during specific operations like data compression, where the system might write data outside of its intended memory boundaries. This can lead to system instability, service outages, or potential unauthorized data modification.
Technical details
A race condition exists in the Linux kernel's GCOV instrumentation due to non-atomic updates of global branch counters. When GCC optimizes loops in functions like inflate_fast(), it may load a global GCOV counter multiple times to calculate loop boundaries. If another CPU modifies this global counter between these loads, the resulting inconsistent values can lead to out-of-bounds memory writes (e.g., writing 3.4 MB past a 65 KB buffer). This was specifically observed during IPComp (IP Payload Compression) processing. The fix involves using the -fprofile-update=prefer-atomic compiler flag to ensure atomic counter updates on supported architectures (x86_64, s390), preventing the compiler from merging counters with loop induction variables.
Affected products
- Linux Linux Kernel All versions prior to fix
Timeline
- 2026-05-11: disclosed: Initial patch submission by Konstantin Khorenko
- 2026-07-04: patched: Patch committed to stable tree
- 2026-07-19: advisory: CVE-2026-63825 published