CVE-2026-80916: Linux Kernel KCOV Race Condition Vulnerability

CVE-2026-80916 Overview

CVE-2026-80916 is a Linux kernel vulnerability in the Kernel Coverage (KCOV) subsystem affecting PREEMPT_RT builds. The flaw causes data corruption and race conditions when nested softirq threads preempt one another on the same CPU. Because softirq handlers run as preemptible task threads on PREEMPT_RT kernels, a higher-priority softirq can overwrite the per-CPU KCOV state saved by a lower-priority softirq. The issue was reported by syzbot and resolved by moving the temporary storage from per-CPU to per-thread. A secondary defect in kcov_init() around vmalloc_node() failure handling is also addressed.

Critical Impact
Nested softirq preemption on PREEMPT_RT kernels corrupts remote KCOV state, and a failed vmalloc_node() in kcov_init() can lead to invalid context allocations, out-of-bounds access, and persistent memory leaks that exhaust OOM-killable userspace processes.

Affected Products

Linux kernel builds with CONFIG_KCOV enabled
Linux kernel builds running with PREEMPT_RT
Stable kernel branches referenced by the fix commits published on kernel.org

Discovery Timeline

2026-09-09 - CVE-2026-80916 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80916

Vulnerability Analysis

KCOV collects code-coverage data from kernel execution paths. Remote KCOV sessions rely on saving and restoring per-task coverage state when execution transitions in and out of asynchronous contexts such as softirqs. The temporary storage used for these save/restore operations was allocated in the per-CPU area.

On PREEMPT_RT kernels, softirq handlers no longer run in traditional non-preemptible interrupt context. They execute as schedulable task threads such as ksoftirqd. This design allows a softirq thread to be preempted by a higher-priority softirq thread on the same CPU. The second softirq overwrites the per-CPU KCOV save area established by the first, permanently destroying the original task's coverage state.

The patch relocates the temporary save area from the per-CPU region to the per-thread task_struct region. Each softirq thread now owns its own context, so nested preemption on the same CPU cannot cause overwrites. The kcov_percpu_data.lock is retained to keep kcov_remote_start() and kcov_remote_stop() atomic against asynchronous interrupts that manipulate the current task's KCOV state.

Root Cause

The root cause is an incorrect storage-scope assumption. The original design treated the per-CPU area as sufficient for saving remote KCOV state during softirq preemption. That assumption holds on non-PREEMPT_RT kernels where softirqs cannot nest. On PREEMPT_RT, preemptible softirq threads invalidate the assumption and produce a race condition [CWE-362] between nested handlers.

A secondary defect exists in kcov_init(). If vmalloc_node() returns NULL, the per-CPU irq_area pointer stays NULL, but kcov_remote_start() assumes it is non-NULL. This inconsistency can trigger vmalloc() from non-task context, out-of-bounds access when kcov->remote_size < CONFIG_KCOV_IRQ_AREA_SIZE, and unbounded memory leaks.

Attack Vector

Exploitation requires local access to a system running a PREEMPT_RT kernel with CONFIG_KCOV enabled and the ability to open /sys/kernel/debug/kcov for remote KCOV sessions. This is a kernel-debugging interface generally restricted to privileged users, so the practical impact is stability and data-integrity corruption during fuzzing or coverage collection rather than a remote attack path. See the kernel.org stable commits for the full patch series.

The vulnerability is described in prose because no verified public exploit code is available. Refer to the technical references for the applied source-level fixes.

Detection Methods for CVE-2026-80916

Indicators of Compromise

Unexpected kernel panics or KCOV-related WARN_ON messages on PREEMPT_RT kernels running syzkaller or similar coverage-guided fuzzers.
Growing unreclaimable vmalloc allocations correlated with repeated kcov_remote_start() invocations after a failed kcov_init().
OOM-killer activity terminating userspace processes while kernel memory accounting shows leaked KCOV irq_area allocations.

Detection Strategies

Audit build configurations for the combination of CONFIG_PREEMPT_RT=y and CONFIG_KCOV=y, which is the vulnerable configuration.
Compare running kernel commit hashes against the fix commits 18799e85, 22670d15, 2eed77fd, 5dc59fc9, 8ed3ddf2, a2fb8222, e11f5b48, ef7048d8, and f8c9a3ec referenced by kernel.org.
Monitor dmesg for KCOV state warnings during CI fuzzing runs.

Monitoring Recommendations

Track kernel version and configuration inventory across real-time Linux fleets used for telecom, industrial, or automotive workloads.
Alert on abnormal vmalloc growth on hosts that enable KCOV in production or lab environments.
Capture kernel logs to centralized storage so that KCOV corruption warnings and OOM events can be correlated across systems.

How to Mitigate CVE-2026-80916

Immediate Actions Required

Apply the stable kernel updates that include the referenced fix commits to any PREEMPT_RT build with CONFIG_KCOV enabled.
Restrict access to /sys/kernel/debug/kcov to trusted administrators and fuzzing infrastructure only.
Rebuild custom kernels from the patched stable branches before redeploying to production or test fleets.

Patch Information

The fix moves the KCOV temporary save area from per-CPU to per-thread storage and hardens kcov_init() against vmalloc_node() returning NULL. Patches are available in the mainline and stable trees through commits including 18799e85, 22670d15, 2eed77fd, 5dc59fc9, 8ed3ddf2, a2fb8222, e11f5b48, ef7048d8, and f8c9a3ec.

Workarounds

Disable CONFIG_KCOV in production PREEMPT_RT kernel builds where coverage collection is not required.
Avoid running remote KCOV sessions on PREEMPT_RT hosts until patched kernels are deployed.
Limit fuzzing workloads that use KCOV to non-PREEMPT_RT test kernels while patches propagate to stable branches.

bash

# Verify KCOV and PREEMPT_RT configuration on the running kernel
zcat /proc/config.gz 2>/dev/null | grep -E 'CONFIG_KCOV|CONFIG_PREEMPT_RT'
# Restrict debugfs access to root only
mount -o remount,mode=700 /sys/kernel/debug