CVE-2026-80916: kcov: fix data corruption and race conditions on PREEMPT_RT

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

kcov: fix data corruption and race conditions on PREEMPT_RT

syzbot is reporting KCOV state corruption on PREEMPT_RT kernels, for the
temporary storage used for saving/restoring remote KCOV state is currently
allocated as the per-CPU area.

On PREEMPT_RT kernels, softirq handlers run as preemptible task threads
(e.g., ksoftirqd). If a softirq context preempts a task running a remote
KCOV session, it safely saves the task's state into the per-CPU area.
However, if that softirq thread is subsequently preempted by a higher-
priority softirq thread on the same CPU, the second softirq will overwrite
the same per-CPU area, permanently destroying the original task's KCOV
state.

Fix this data corruption by moving the temporary storage from the per-CPU
area to the per-thread area. Since each softirq thread now owns its own
task context, nested softirq preemption no longer causes data overwrites.

Note that while the temporary storage is now on a per-thread basis, the
per-CPU kcov_percpu_data.lock must be retained, for we need to ensure that
kcov_remote_start() and kcov_remote_stop() operate atomically without
racing against asynchronous interrupts that manipulate the current task's
KCOV state.

It is likely that GFP_KERNEL allocation by vmalloc_node() in kcov_init()
has already called panic() before returning NULL, for there will be no
OOM-killable userspace processes when __init function of built-in module
runs. But this patch also fixes crashing the kernel when vmalloc_node()
in kcov_init() returned NULL, for kcov_init() left per-CPU irq_area == NULL
but kcov_remote_start() depends on per-CPU irq_area != NULL, resulting in

  (1) doing vmalloc() in kcov_remote_start() despite !in_task() context

  (2) out-of-array-bounds access if (1) succeeded but
      kcov->remote_size < CONFIG_KCOV_IRQ_AREA_SIZE

  (3) always leak memory allocated by (1), eventually killing all
      OOM-killable userspace processes

problems.

The Linux kernel CVE team has assigned CVE-2026-80916 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.8 with commit 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 and fixed in 5.10.269 with commit ef7048d8a614c5f5a9b20513a5428101a744514e
	Issue introduced in 5.8 with commit 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 and fixed in 5.15.220 with commit 8ed3ddf23d39bf5338406bd9f8863d44748cf6ce
	Issue introduced in 5.8 with commit 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 and fixed in 6.1.185 with commit 5dc59fc959b2b5742985d7ef24bccd1868217dc2
	Issue introduced in 5.8 with commit 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 and fixed in 6.6.154 with commit a2fb8222cde23b0001812ed3acb7c0ea36dd94e2
	Issue introduced in 5.8 with commit 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 and fixed in 6.12.106 with commit 18799e858b407bf355383c9dd6c06477aa437134
	Issue introduced in 5.8 with commit 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 and fixed in 6.18.47 with commit e11f5b48c82703242a3be7a7ae4b4940b4cb4610
	Issue introduced in 5.8 with commit 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 and fixed in 7.1.11 with commit 22670d1552fe155822b2abf91f920925f7d067b4
	Issue introduced in 5.8 with commit 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 and fixed in 7.2.1 with commit f8c9a3ec36b4ee3d4701b9be08f40e7bfbf89761
	Issue introduced in 5.8 with commit 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 and fixed in 7.3-rc1 with commit 2eed77fdcb0cc48e8eccb2bcd4b7f2c6d650e84c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-80916
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/linux/sched.h
	kernel/kcov.c
	lib/Kconfig.debug


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ef7048d8a614c5f5a9b20513a5428101a744514e
	https://git.kernel.org/stable/c/8ed3ddf23d39bf5338406bd9f8863d44748cf6ce
	https://git.kernel.org/stable/c/5dc59fc959b2b5742985d7ef24bccd1868217dc2
	https://git.kernel.org/stable/c/a2fb8222cde23b0001812ed3acb7c0ea36dd94e2
	https://git.kernel.org/stable/c/18799e858b407bf355383c9dd6c06477aa437134
	https://git.kernel.org/stable/c/e11f5b48c82703242a3be7a7ae4b4940b4cb4610
	https://git.kernel.org/stable/c/22670d1552fe155822b2abf91f920925f7d067b4
	https://git.kernel.org/stable/c/f8c9a3ec36b4ee3d4701b9be08f40e7bfbf89761
	https://git.kernel.org/stable/c/2eed77fdcb0cc48e8eccb2bcd4b7f2c6d650e84c