From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B7A17580384 for ; Wed, 9 Sep 2026 16:13:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788970406; cv=none; b=HSg73lxACPWh5wa2Q3sNw52ZtaB2B+1Zadpfi3HTURzvGe4g7WDQzqG+qhG/bfLoeHSiM78wi9SXke2YIn0B1cJmjuWIyZveUp/QCHZAFWHlR6z4wphGXVene7Rx/531SXzeB+kwRVR7oc94S60A6Xd9rorWRLcpq+baVXzOe0M= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788970406; c=relaxed/simple; bh=ZAke9bQqiHrmB2Mn+RIQ9bryDHNTdFWtKG9r502jUOk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=sl16Vj0RnkOrVBIpMv+HX4lQ5C+wXSrtgeEep/6SPqnX077/pG4KW37CRRz3EBsOHDpjVWpmfYufBZdtSpEDg/lZOHPnBmrzhwR/9cdIpDnfIi8F+928tbdoWb//sZEnDkMh5KLUAX0LpuFYgSbaCPbHDPFQfFGo/chAp0Qq1Gc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=D9fqxuoD; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="D9fqxuoD" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A61811F00A3A; Wed, 9 Sep 2026 16:13:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788970404; bh=otNyaROYyz41hEwSdOggV2EglWTBI6bbjIBY81sDrPU=; h=From:To:Cc:Subject:Date:Reply-To; b=D9fqxuoDC4WvEygO/ZiGPcRwjWsqny6XRFhVyH2BNglJB2b7rQ42iwUwSJqIiCeld STUJjll89ldqcRsSN6ZVAD7kC8RRakzZMDg1X4GxCVjMQHIPXa5HQt0YndzKODCQsW cKZ5YCzSbrIyWFku9lTqWAuY8YyI9t8If5V6SYKw= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-80916: kcov: fix data corruption and race conditions on PREEMPT_RT Date: Wed, 9 Sep 2026 18:13:16 +0200 Message-ID: <2026090914-CVE-2026-80916-00ed@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5315; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=WMnbAAK3Wh6ZqTulJvZDshIpNzuu+/gMksrgS1wFuI4=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkLW2fVelw6p6+2vvC4TKnv5qZFfsGdTT7l2VX+S+4eD g/2W3WzI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACaSvZRhwcloPW1XzsM/mmUy l/7eMcfMe6XUBYb5KZLO9yvU1jy9lbv7XLmlb1hPWucVAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: kcov: fix data corruption and race conditions on PREEMPT_RT syzbot is reporting KCOV state corruption on PREEMPT_RT kernels, for the temporary storage used for saving/restoring remote KCOV state is currently allocated as the per-CPU area. On PREEMPT_RT kernels, softirq handlers run as preemptible task threads (e.g., ksoftirqd). If a softirq context preempts a task running a remote KCOV session, it safely saves the task's state into the per-CPU area. However, if that softirq thread is subsequently preempted by a higher- priority softirq thread on the same CPU, the second softirq will overwrite the same per-CPU area, permanently destroying the original task's KCOV state. Fix this data corruption by moving the temporary storage from the per-CPU area to the per-thread area. Since each softirq thread now owns its own task context, nested softirq preemption no longer causes data overwrites. Note that while the temporary storage is now on a per-thread basis, the per-CPU kcov_percpu_data.lock must be retained, for we need to ensure that kcov_remote_start() and kcov_remote_stop() operate atomically without racing against asynchronous interrupts that manipulate the current task's KCOV state. It is likely that GFP_KERNEL allocation by vmalloc_node() in kcov_init() has already called panic() before returning NULL, for there will be no OOM-killable userspace processes when __init function of built-in module runs. But this patch also fixes crashing the kernel when vmalloc_node() in kcov_init() returned NULL, for kcov_init() left per-CPU irq_area == NULL but kcov_remote_start() depends on per-CPU irq_area != NULL, resulting in (1) doing vmalloc() in kcov_remote_start() despite !in_task() context (2) out-of-array-bounds access if (1) succeeded but kcov->remote_size < CONFIG_KCOV_IRQ_AREA_SIZE (3) always leak memory allocated by (1), eventually killing all OOM-killable userspace processes problems. The Linux kernel CVE team has assigned CVE-2026-80916 to this issue. Affected and fixed versions =========================== Issue introduced in 5.8 with commit 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 and fixed in 5.10.269 with commit ef7048d8a614c5f5a9b20513a5428101a744514e Issue introduced in 5.8 with commit 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 and fixed in 5.15.220 with commit 8ed3ddf23d39bf5338406bd9f8863d44748cf6ce Issue introduced in 5.8 with commit 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 and fixed in 6.1.185 with commit 5dc59fc959b2b5742985d7ef24bccd1868217dc2 Issue introduced in 5.8 with commit 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 and fixed in 6.6.154 with commit a2fb8222cde23b0001812ed3acb7c0ea36dd94e2 Issue introduced in 5.8 with commit 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 and fixed in 6.12.106 with commit 18799e858b407bf355383c9dd6c06477aa437134 Issue introduced in 5.8 with commit 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 and fixed in 6.18.47 with commit e11f5b48c82703242a3be7a7ae4b4940b4cb4610 Issue introduced in 5.8 with commit 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 and fixed in 7.1.11 with commit 22670d1552fe155822b2abf91f920925f7d067b4 Issue introduced in 5.8 with commit 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 and fixed in 7.2.1 with commit f8c9a3ec36b4ee3d4701b9be08f40e7bfbf89761 Issue introduced in 5.8 with commit 5ff3b30ab57da82d8db4f14662a2858cabfbc2c0 and fixed in 7.3-rc1 with commit 2eed77fdcb0cc48e8eccb2bcd4b7f2c6d650e84c Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-80916 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: include/linux/sched.h kernel/kcov.c lib/Kconfig.debug Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/ef7048d8a614c5f5a9b20513a5428101a744514e https://git.kernel.org/stable/c/8ed3ddf23d39bf5338406bd9f8863d44748cf6ce https://git.kernel.org/stable/c/5dc59fc959b2b5742985d7ef24bccd1868217dc2 https://git.kernel.org/stable/c/a2fb8222cde23b0001812ed3acb7c0ea36dd94e2 https://git.kernel.org/stable/c/18799e858b407bf355383c9dd6c06477aa437134 https://git.kernel.org/stable/c/e11f5b48c82703242a3be7a7ae4b4940b4cb4610 https://git.kernel.org/stable/c/22670d1552fe155822b2abf91f920925f7d067b4 https://git.kernel.org/stable/c/f8c9a3ec36b4ee3d4701b9be08f40e7bfbf89761 https://git.kernel.org/stable/c/2eed77fdcb0cc48e8eccb2bcd4b7f2c6d650e84c