Executive brief
A flaw in Linux kernel code coverage (KCOV) handling on PREEMPT_RT kernels causes data corruption when softirq threads preempt each other. This can lead to loss of kernel coverage data and potential kernel crashes due to memory management issues. The impact is primarily on development and testing systems using PREEMPT_RT configurations.
Technical details
The vulnerability involves a race condition in KCOV state management on PREEMPT_RT kernels where softirq handlers run as preemptible task threads. Temporary storage for saving/restoring remote KCOV state was allocated as per-CPU area; when nested softirq preemption occurs, a higher-priority softirq thread overwrites the same per-CPU area, destroying the original task's KCOV state. The fix moves temporary storage from per-CPU to per-thread area. Additionally, improper NULL pointer handling in kcov_init() can lead to vmalloc() calls in non-task context, out-of-bounds access, and memory leaks that eventually crash the kernel.
Affected products
- Linux Linux kernel PREEMPT_RT enabled kernels
Timeline
- 2026-09-09: disclosed