CVE-2026-64167

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> kho: skip KHO for crash kernel<br /> <br /> kho_fill_kimage() unconditionally populates the kimage with KHO<br /> metadata for every kexec image type. When the image is a crash kernel,<br /> this can be problematic as the crash kernel can run in a small reserved<br /> region and the KHO scratch areas can sit outside it.<br /> The crash kernel then faults during kho_memory_init() when it<br /> tries phys_to_virt() on the KHO FDT address:<br /> <br /> Unable to handle kernel paging request at virtual address xxxxxxxx<br /> ...<br /> fdt_offset_ptr+...<br /> fdt_check_node_offset_+...<br /> fdt_first_property_offset+...<br /> fdt_get_property_namelen_+...<br /> fdt_getprop+...<br /> kho_memory_init+...<br /> mm_core_init+...<br /> start_kernel+...<br /> <br /> kho_locate_mem_hole() already skips KHO logic for KEXEC_TYPE_CRASH<br /> images, but kho_fill_kimage() was missing the same guard. As<br /> kho_fill_kimage() is the single point that populates image-&gt;kho.fdt<br /> and image-&gt;kho.scratch, fixing it here is sufficient for both arm64<br /> and x86 as the FDT and boot_params path are bailing out when these<br /> fields are unset.