The Linux kernel's GCOV instrumentation merged global branch counters with loop induction variables for optimization. In the inflate_fast() function, multiple loads of the same global GCOV counter occurred to compute loop parameters. Since these counters are global and not per-CPU, concurrent execution on multiple CPUs caused the counter to change between loads, resulting in inconsistent values and out-of-bounds writes. This manifested as a crash during IPComp processing. The fix involves adding the compiler flag -fprofile-update=prefer-atomic to enable atomic counter updates where supported, preventing the compiler from merging counters with loop variables and eliminating the concurrency issue. The flag is conditionally applied based on architecture support to avoid introducing unwanted dependencies.

Concurrent execution of inflate_fast() on multiple CPUs could cause out-of-bounds memory writes leading to kernel crashes (page faults). This affects IP Payload Compression processing and could cause system instability or denial of service. There is no indication of privilege escalation or code execution from the provided data.

A fix has been implemented by modifying the kernel build process to add the -fprofile-update=prefer-atomic compiler flag conditionally, enabling atomic updates to GCOV counters and preventing concurrent access crashes. This fix is architecture-dependent and omitted where it would introduce unsupported dependencies. Users should update to the Linux kernel version that includes this patch. Patch status is not explicitly confirmed here; check the vendor advisory or Linux kernel mailing lists for the exact fixed versions and update accordingly.