LiveActive security incident?Get immediate response
CVE Record

CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments()

In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Disable KCOV instrumentation after load_segments() The load_segments() function changes segment registers, invalidating GS base (which KCOV relies on for per-cpu data). When CONFIG_KCOV is enabled, any subsequent instrumented C code call (e.g. native_gdt_invalidate()) begins crashing the kernel in an endless loop. To reproduce the problem, it's sufficient to do kexec on a KCOV-instrumented kernel: $ kexec -l /boot/otherKernel $ kexec -e The real-world context for this problem is enabling crash dump collection in syzkaller. For this, the tool loads a panic kernel before fuzzing and then calls makedumpfile after the panic. This workflow requires both CONFIG_KEXEC and CONFIG_KCOV to be enabled simultaneously. Adding safeguards directly to the KCOV fast-path (__sanitizer_cov_trace_pc()) is also undesirable as it would introduce an extra performance overhead. Disabling instrumentation for the individual functions would be too fragile, so disable KCOV instrumentation for the entire machine_kexec_64.c and physaddr.c. If coverage-guided fuzzing ever needs these components in the future, other approaches should be considered. The problem is not relevant for 32 bit kernels as CONFIG_KCOV is not supported there. [ bp: Space out comment for better readability. ]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel stability bug, not a remote compromise issue based on the sources. On x86 systems using both kexec and KCOV, a kernel handoff can crash repeatedly. The most likely business impact is failed crash-dump or fuzzing infrastructure, not broad production exposure.

Executive priority

Treat as low urgency for typical production fleets, higher for kernel fuzzing, crash-dump, or lab systems using KCOV and kexec. Track vendor kernel updates and patch affected specialized systems during normal maintenance.

Technical view

After load_segments changes segment registers, GS base becomes invalid for KCOV per-cpu data. If CONFIG_KCOV remains active, later instrumented C code can enter an endless kernel-crash loop during kexec. The fix disables KCOV instrumentation for machine_kexec_64.c and physaddr.c. Sources state 32-bit kernels are not relevant.

Likely exposure

Exposure appears limited to x86 Linux kernels built with both CONFIG_KEXEC and CONFIG_KCOV. The described real-world case is syzkaller crash-dump collection. Standard production kernels are less likely to enable KCOV, but custom testing, fuzzing, or crash-analysis kernels should be checked.

Exploitation context

The CVE source describes local reproduction through kexec on a KCOV-instrumented kernel. There is no KEV listing and no cited evidence of active exploitation. The sources do not describe remote attackability or privilege-free triggering.

Researcher notes

The issue is a KCOV instrumentation interaction after x86 kexec segment changes invalidate GS-base assumptions. Evidence supports a denial-of-service style crash loop during kexec, not privilege escalation or remote exploitation. Affected-version data in the bundle is sparse, so validate using vendor advisories and kernel config.

Mitigation direction

  • Apply vendor kernel updates containing the referenced stable fixes.
  • Check distribution advisories for affected package versions and backports.
  • Avoid combining CONFIG_KCOV and CONFIG_KEXEC on x86 until patched.
  • Restrict kexec capability to trusted administrative workflows.
  • Prioritize fuzzing and crash-dump hosts using custom kernels.

Validation and detection

  • Inventory x86 hosts running custom or testing kernels.
  • Confirm whether CONFIG_KCOV and CONFIG_KEXEC are both enabled.
  • Check kernel version and vendor backport status against advisories.
  • Review crash-dump and syzkaller infrastructure for kexec failures.
  • Verify patched kernels include the referenced stable commits.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-43331 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux0d345996e4cb573f8cc81d49b3ee9a7fd2035bef, 0d345996e4cb573f8cc81d49b3ee9a7fd2035bef, 0d345996e4cb573f8cc81d49b3ee9a7fd2035bef, 0d345996e4cb573f8cc81d49b3ee9a7fd2035befunaffected
LinuxLinux6.6, 0, 6.12.93, 6.18.22, 6.19.12, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.