CVE-2026-43331

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/kexec: Disable KCOV instrumentation after load_segments()

The load_segments() function changes segment registers, invalidating GS base

(which KCOV relies on for per-cpu data). When CONFIG_KCOV is enabled, any

subsequent instrumented C code call (e.g. native_gdt_invalidate()) begins

crashing the kernel in an endless loop.

To reproduce the problem, it's sufficient to do kexec on a KCOV-instrumented

kernel:

$ kexec -l /boot/otherKernel

$ kexec -e

The real-world context for this problem is enabling crash dump collection in

syzkaller. For this, the tool loads a panic kernel before fuzzing and then

calls makedumpfile after the panic. This workflow requires both CONFIG_KEXEC

and CONFIG_KCOV to be enabled simultaneously.

Adding safeguards directly to the KCOV fast-path (__sanitizer_cov_trace_pc())

is also undesirable as it would introduce an extra performance overhead.

Disabling instrumentation for the individua

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References