CVE-2026-63825

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

gcov: use atomic counter updates to fix concurrent access crashes

GCC's GCOV instrumentation can merge global branch counters with loop

induction variables as an optimization. In inflate_fast(), the inner copy

loops get transformed so that the GCOV counter value is loaded multiple

times to compute the loop base address, start index, and end bound. Since

GCOV counters are global (not per-CPU), concurrent execution on different

CPUs causes the counter to change between loads, producing inconsistent

values and out-of-bounds memory writes.

The crash manifests during IPComp (IP Payload Compression) processing when

inflate_fast() runs concurrently on multiple CPUs:

BUG: unable to handle page fault for address: ffffd0a3c0902ffa

RIP: inflate_fast+1431

Call Trace:

zlib_inflate

__deflate_decompress

crypto_comp_decompress

ipcomp_decompress [xfrm_ipcomp]

ipcomp_input [xfrm_ipcomp]

xfrm_input

At the c

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References