VOOZH about

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43331

⇱ NVD - CVE-2026-43331

  1. Vulnerabilities

CVE-2026-43331 Detail

Modified After Enrichment

This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.

Description

In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Disable KCOV instrumentation after load_segments() The load_segments() function changes segment registers, invalidating GS base (which KCOV relies on for per-cpu data). When CONFIG_KCOV is enabled, any subsequent instrumented C code call (e.g. native_gdt_invalidate()) begins crashing the kernel in an endless loop. To reproduce the problem, it's sufficient to do kexec on a KCOV-instrumented kernel: $ kexec -l /boot/otherKernel $ kexec -e The real-world context for this problem is enabling crash dump collection in syzkaller. For this, the tool loads a panic kernel before fuzzing and then calls makedumpfile after the panic. This workflow requires both CONFIG_KEXEC and CONFIG_KCOV to be enabled simultaneously. Adding safeguards directly to the KCOV fast-path (__sanitizer_cov_trace_pc()) is also undesirable as it would introduce an extra performance overhead. Disabling instrumentation for the individual functions would be too fragile, so disable KCOV instrumentation for the entire machine_kexec_64.c and physaddr.c. If coverage-guided fuzzing ever needs these components in the future, other approaches should be considered. The problem is not relevant for 32 bit kernels as CONFIG_KCOV is not supported there. [ bp: Space out comment for better readability. ]


Metrics

 
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL Source(s) Tag(s)
https://git.kernel.org/stable/c/0e96cd314c0d819c1635d68125a4d77852c2162e kernel.org
https://git.kernel.org/stable/c/1e3e98596c2769721ade0418434852fb3af4849a kernel.org Patch 
https://git.kernel.org/stable/c/593d67032544b9271094fc9b43e437e017cb2b2f kernel.org
https://git.kernel.org/stable/c/917e3ad3321e75ca0223d5ccf26ceda116aa51e1 kernel.org Patch 
https://git.kernel.org/stable/c/de05c66fab8847237a9ca216934e56d3ee837f08 kernel.org Patch 

Weakness Enumeration

CWE-ID CWE Name Source
NVD-CWE-noinfo Insufficient Information 👁 cwe source acceptance level
NIST  

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

5 change records found show changes

CVE Modified by kernel.org 6/19/2026 9:16:29 AM

Action Type Old Value New Value
Added Reference 
https://git.kernel.org/stable/c/0e96cd314c0d819c1635d68125a4d77852c2162e
Changed Affected 
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/kernel/Makefile","arch/x86/mm/Makefile"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0d345996e4cb573f8cc81d49b3ee9a7fd2035bef","lessThan":"593d67032544b9271094fc9b43e437e017cb2b2f","versionType":"git","status":"affected"},{"version":"0d345996e4cb573f8cc81d49b3ee9a7fd2035bef","lessThan":"1e3e98596c2769721ade0418434852fb3af4849a","versionType":"git","status":"affected"},{"version":"0d345996e4cb573f8cc81d49b3ee9a7fd2035bef","lessThan":"de05c66fab8847237a9ca216934e56d3ee837f08","versionType":"git","status":"affected"},{"version":"0d345996e4cb573f8cc81d49b3ee9a7fd2035bef","lessThan":"917e3ad3321e75ca0223d5ccf26ceda116aa51e1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/kernel/Makefile","arch/x86/mm/Makefile"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.22","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"6.19.12","lessThanOrEqual":"6.19.*","versionType":"semver","status":"unaffected"},{"version":"7.0","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]


 
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/kernel/Makefile","arch/x86/mm/Makefile"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0d345996e4cb573f8cc81d49b3ee9a7fd2035bef","lessThan":"0e96cd314c0d819c1635d68125a4d77852c2162e","versionType":"git","status":"affected"},{"version":"0d345996e4cb573f8cc81d49b3ee9a7fd2035bef","lessThan":"593d67032544b9271094fc9b43e437e017cb2b2f","versionType":"git","status":"affected"},{"version":"0d345996e4cb573f8cc81d49b3ee9a7fd2035bef","lessThan":"1e3e98596c2769721ade0418434852fb3af4849a","versionType":"git","status":"affected"},{"version":"0d345996e4cb573f8cc81d49b3ee9a7fd2035bef","lessThan":"de05c66fab8847237a9ca216934e56d3ee837f08","versionType":"git","status":"affected"},{"version":"0d345996e4cb573f8cc81d49b3ee9a7fd2035bef","lessThan":"917e3ad3321e75ca0223d5ccf26ceda116aa51e1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/kernel/Makefile","arch/x86/mm/Makefile"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.22","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"6.19.12","lessThanOrEqual":"6.19.*","versionType":"semver","status":"unaffected"},{"version":"7.0","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

CVE Modified by kernel.org 6/17/2026 6:49:23 AM

Action Type Old Value New Value
Added Affected 
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/kernel/Makefile","arch/x86/mm/Makefile"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0d345996e4cb573f8cc81d49b3ee9a7fd2035bef","lessThan":"593d67032544b9271094fc9b43e437e017cb2b2f","versionType":"git","status":"affected"},{"version":"0d345996e4cb573f8cc81d49b3ee9a7fd2035bef","lessThan":"1e3e98596c2769721ade0418434852fb3af4849a","versionType":"git","status":"affected"},{"version":"0d345996e4cb573f8cc81d49b3ee9a7fd2035bef","lessThan":"de05c66fab8847237a9ca216934e56d3ee837f08","versionType":"git","status":"affected"},{"version":"0d345996e4cb573f8cc81d49b3ee9a7fd2035bef","lessThan":"917e3ad3321e75ca0223d5ccf26ceda116aa51e1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/kernel/Makefile","arch/x86/mm/Makefile"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.22","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"6.19.12","lessThanOrEqual":"6.19.*","versionType":"semver","status":"unaffected"},{"version":"7.0","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

CVE Modified by kernel.org 6/09/2026 7:16:51 AM

Action Type Old Value New Value
Added Reference 
https://git.kernel.org/stable/c/593d67032544b9271094fc9b43e437e017cb2b2f

Initial Analysis by NIST 5/18/2026 8:39:01 AM

Action Type Old Value New Value
Added CVSS V3.1 
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Added CWE 
NVD-CWE-noinfo
Added CPE Configuration 
OR
 *cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
 *cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
 *cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
 *cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
 *cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
 *cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 6.19.12
 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.6 up to (excluding) 6.18.22
Added Reference Type 
kernel.org: https://git.kernel.org/stable/c/1e3e98596c2769721ade0418434852fb3af4849a Types: Patch
Added Reference Type 
kernel.org: https://git.kernel.org/stable/c/917e3ad3321e75ca0223d5ccf26ceda116aa51e1 Types: Patch
Added Reference Type 
kernel.org: https://git.kernel.org/stable/c/de05c66fab8847237a9ca216934e56d3ee837f08 Types: Patch

New CVE Received from kernel.org 5/08/2026 10:16:42 AM

Action Type Old Value New Value
Added Description 
In the Linux kernel, the following vulnerability has been resolved:

x86/kexec: Disable KCOV instrumentation after load_segments()

The load_segments() function changes segment registers, invalidating GS base
(which KCOV relies on for per-cpu data). When CONFIG_KCOV is enabled, any
subsequent instrumented C code call (e.g. native_gdt_invalidate()) begins
crashing the kernel in an endless loop.

To reproduce the problem, it's sufficient to do kexec on a KCOV-instrumented
kernel:

 $ kexec -l /boot/otherKernel
 $ kexec -e

The real-world context for this problem is enabling crash dump collection in
syzkaller. For this, the tool loads a panic kernel before fuzzing and then
calls makedumpfile after the panic. This workflow requires both CONFIG_KEXEC
and CONFIG_KCOV to be enabled simultaneously.

Adding safeguards directly to the KCOV fast-path (__sanitizer_cov_trace_pc())
is also undesirable as it would introduce an extra performance overhead.

Disabling instrumentation for the individual functions would be too fragile,
so disable KCOV instrumentation for the entire machine_kexec_64.c and
physaddr.c. If coverage-guided fuzzing ever needs these components in the
future, other approaches should be considered.

The problem is not relevant for 32 bit kernels as CONFIG_KCOV is not supported
there.

 [ bp: Space out comment for better readability. ]
Added Reference 
https://git.kernel.org/stable/c/1e3e98596c2769721ade0418434852fb3af4849a
Added Reference 
https://git.kernel.org/stable/c/917e3ad3321e75ca0223d5ccf26ceda116aa51e1
Added Reference 
https://git.kernel.org/stable/c/de05c66fab8847237a9ca216934e56d3ee837f08

Quick Info

CVE Dictionary Entry:
CVE-2026-43331
NVD Published Date:
05/08/2026
NVD Last Modified:
06/19/2026
Source:
kernel.org