CVE-2026-64167

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

kho: skip KHO for crash kernel

kho_fill_kimage() unconditionally populates the kimage with KHO

metadata for every kexec image type. When the image is a crash kernel,

this can be problematic as the crash kernel can run in a small reserved

region and the KHO scratch areas can sit outside it.

The crash kernel then faults during kho_memory_init() when it

tries phys_to_virt() on the KHO FDT address:

Unable to handle kernel paging request at virtual address xxxxxxxx

...

fdt_offset_ptr+...

fdt_check_node_offset_+...

fdt_first_property_offset+...

fdt_get_property_namelen_+...

fdt_getprop+...

kho_memory_init+...

mm_core_init+...

start_kernel+...

kho_locate_mem_hole() already skips KHO logic for KEXEC_TYPE_CRASH

images, but kho_fill_kimage() was missing the same guard. As

kho_fill_kimage() is the single point that populates image->kho.fdt

and image->kho.scratch, fixing it here is sufficien

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References