CVE-2026-64167 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
kho: skip KHO for crash kernel
kho_fill_kimage() unconditionally populates the kimage with KHO metadata for every kexec image type. When the image is a crash kernel, this can be problematic as the crash kernel can run in a small reserved region and the KHO scratch areas can sit outside it. The crash kernel then faults during kho_memory_init() when it tries phys_to_virt() on the KHO FDT address:
Unable to handle kernel paging request at virtual address xxxxxxxx ... fdt_offset_ptr+... fdt_check_node_offset_+... fdt_first_property_offset+... fdt_get_property_namelen_+... fdt_getprop+... kho_memory_init+... mm_core_init+... start_kernel+...
kho_locate_mem_hole() already skips KHO logic for KEXEC_TYPE_CRASH images, but kho_fill_kimage() was missing the same guard. As kho_fill_kimage() is the single point that populates image->kho.fdt and image->kho.scratch, fixing it here is sufficient for both arm64 and x86 as the FDT and boot_params path are bailing out when these fields are unset.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability exists within the linux kernel's kexec implementation where the kho_fill_kimage() function fails to properly distinguish between different kexec image types during kernel crash dump initialization. The issue stems from an unconditional population of KHO metadata for all kexec image types without proper consideration of crash kernel constraints. When a crash kernel is being loaded, it operates within a small reserved memory region that may not accommodate the KHO scratch areas required by the kernel's memory management subsystem.
The technical flaw manifests when the crash kernel attempts to initialize memory management components through kho_memory_init() function. During this process, the system calls phys_to_virt() on the KHO FDT address which results in a kernel paging fault due to memory access violations. This occurs because the KHO scratch areas are positioned outside the limited reserved region allocated for crash kernels, creating an invalid memory access pattern that triggers the kernel's page fault handler with the specific error trace showing fdt_offset_ptr and related functions failing during FDT property access.
The operational impact of this vulnerability is significant as it prevents proper crash kernel initialization on systems utilizing kexec for crash dumps. This essentially breaks the kernel crash dump functionality, leaving systems unable to generate memory dumps when a kernel panic occurs, which is critical for post-mortem debugging and system reliability analysis. The vulnerability affects both arm64 and x86 architectures since the fix addresses the core issue in kho_fill_kimage() that handles FDT and boot_params paths universally.
This vulnerability maps to CWE-125: Out-of-bounds Read and CWE-787: Out-of-bounds Write within the Common Weakness Enumeration framework, as it involves improper memory access patterns during kernel initialization. From an ATT&CK perspective, this represents a privilege escalation vector through kernel memory corruption that could potentially be exploited to gain elevated system privileges or cause denial of service conditions. The fix implements proper conditional logic similar to kho_locate_mem_hole() function which already correctly handles KEXEC_TYPE_CRASH images by skipping KHO processing for crash kernels.
The mitigation strategy involves modifying the kho_fill_kimage() function to include a guard clause that prevents KHO metadata population for crash kernel images, aligning it with the existing behavior in kho_locate_mem_hole(). This ensures that crash kernels only access memory regions within their designated reserved areas. The solution maintains backward compatibility while preventing the memory access violations that occur during crash kernel initialization. Organizations should apply this kernel patch to systems utilizing kexec-based crash dump functionality to maintain system stability and ensure proper debugging capabilities during kernel failures.
This vulnerability represents a critical race condition in kernel memory management where improper resource allocation leads to kernel panic conditions, directly impacting system reliability and availability. The fix demonstrates the importance of proper memory boundary checking in kernel subsystems and highlights how seemingly simple code modifications can have significant impacts on system stability and debuggability. The resolution maintains the existing crash dump functionality while preventing the specific memory access violations that were causing system crashes during kernel initialization phases.