CVE-2026-64167 Linux CVE debrief

Who should care

Linux kernel developers and users who rely on crash kernels should be aware of this vulnerability and take necessary precautions. This includes reviewing and applying the patch to skip KHO for crash kernel, monitoring Linux kernel updates for further patches, and considering implementing compensating controls for crash kernels. Affected operators, platforms, and security teams should review the official advisory for guidance on affected systems and take steps to mitigate the vulnerability.

Technical summary

The Linux kernel vulnerability CVE-2026-64167 was caused by kho_fill_kimage() unconditionally populating the kimage with KHO metadata for every kexec image type. This can be problematic for crash kernels as they can run in a small reserved region and the KHO scratch areas can sit outside it. The crash kernel then faults during kho_memory_init() when it tries phys_to_virt() on the KHO FDT address. The fix involves adding a guard to kho_fill_kimage() to skip KHO logic for KEXEC_TYPE_CRASH images, which is sufficient for both arm64 and x86.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to skip KHO for crash kernel
• Monitor Linux kernel updates for further patches
• Consider implementing compensating controls for crash kernels
• Review the official advisory for guidance on affected systems
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record was published on 2026-07-19T16:17:58.833Z and has not been modified since then. The NVD entry is currently Received. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the official advisory. The vulnerability affects Linux kernel deployments, and defenders should review the official advisory for guidance on affected systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.