CVE-2026-64167
Received Received - Intake

Memory Corruption in Linux Kernel Kexec Crash Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: kho: skip KHO for crash kernel kho_fill_kimage() unconditionally populates the kimage with KHO metadata for every kexec image type. When the image is a crash kernel, this can be problematic as the crash kernel can run in a small reserved region and the KHO scratch areas can sit outside it. The crash kernel then faults during kho_memory_init() when it tries phys_to_virt() on the KHO FDT address: Unable to handle kernel paging request at virtual address xxxxxxxx ... fdt_offset_ptr+... fdt_check_node_offset_+... fdt_first_property_offset+... fdt_get_property_namelen_+... fdt_getprop+... kho_memory_init+... mm_core_init+... start_kernel+... kho_locate_mem_hole() already skips KHO logic for KEXEC_TYPE_CRASH images, but kho_fill_kimage() was missing the same guard. As kho_fill_kimage() is the single point that populates image->kho.fdt and image->kho.scratch, fixing it here is sufficient for both arm64 and x86 as the FDT and boot_params path are bailing out when these fields are unset.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64167
EUVD
EUVD-2026-45852

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of KHO metadata during kexec operations for crash kernels. The function kho_fill_kimage() populates crash kernel images with KHO metadata without checking if the image is a crash kernel, which can cause the crash kernel to fault when accessing memory outside its reserved region during initialization.

Detection Guidance

This vulnerability is specific to the Linux kernel and can be detected by checking the kernel version and verifying if the affected function kho_fill_kimage() is present. Use commands like 'uname -a' to check the kernel version and 'grep kho_fill_kimage /proc/kallsyms' to see if the function is loaded.

Impact Analysis

This vulnerability can cause system crashes or instability when performing kexec operations to load a crash kernel. The crash kernel may fail to initialize properly, leading to kernel panic or inability to handle system failures, which could disrupt critical services or data recovery processes.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a Linux kernel issue related to crash kernel memory handling. Compliance impacts would depend on system configuration and usage rather than the vulnerability itself.

Mitigation Strategies

Apply the latest kernel patch that resolves this issue. Update your Linux kernel to a version that includes the fix for CVE-2026-64167. Monitor kernel logs for crash kernel faults during boot.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64167. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart