CVE-2026-63825
A bug in the Linux kernel’s GCOV instrumentation can cause out‑of‑bounds memory writes when multiple CPUs run the inflate_fast() function concurrently. The issue is triggered during IPComp processing and can crash the system. The patch adds atomic counter updates to prevent the race.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel versions that use GCC GCOV instrumentation before the patch; all users running those kernels are affected.
Real-world impact
An attacker could trigger a crash or memory corruption during IPComp, leading to denial of service or potentially arbitrary code execution if the memory corruption is exploitable.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network, requires no authentication, and can compromise confidentiality, integrity, and availability, with no user interaction needed.
What to do about it
- 01Apply the kernel patch that adds -fprofile-update=prefer-atomic to CFLAGS_GCOV.
- 02Rebuild the kernel with the updated source.
- 03Install the updated kernel and reboot the system.
NVD description
Timeline
- Jul 19, 2026 · 14d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 27, 2026 · 6d agoAdvisory updatedThe NVD record was last revised.