CVE-2026-64167 kho: skip KHO for crash kernel
A missing guard in the Linux kernel causes a null dereference crash when loading a crash kernel with KHO metadata, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64167?
CVE-2026-64167 is a medium-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
kho: skip KHO for crash kernel
kho_fill_kimage() unconditionally populates the kimage with KHO metadata for every kexec image type. When the image is a crash kernel, this can be problematic as the crash kernel can run in a small reserved region and the KHO scratch areas can sit outside it. The crash kernel then faults during kho_memory_init() when it tries phys_to_virt() on the KHO FDT address:
Unable to handle kernel paging request at virtual address xxxxxxxx ... fdt_offset_ptr+... fdt_check_node_offset_+... fdt_first_property_offset+... fdt_get_property_namelen_+... fdt_getprop+... kho_memory_init+... mm_core_init+... start_kernel+...
kho_locate_mem_hole() already skips KHO logic for KEXEC_TYPE_CRASH images, but kho_fill_kimage() was missing the same guard. As kho_fill_kimage() is the single point that populates image->kho.fdt and image->kho.scratch, fixing it here is sufficient for both arm64 and x86 as the FDT and boot_params path are bailing out when these fields are unset.
Weakness: CWE-476
Which versions are affected by CVE-2026-64167?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64167?
Apply the vendor's patch.
Is CVE-2026-64167 being exploited?
There is no known exploitation of CVE-2026-64167 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2026-64167, GHSA-8x2c-32p7-vm7c, UBUNTU-CVE-2026-64167.