PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64167 Linux CVE debrief

The Linux kernel vulnerability CVE-2026-64167 has been resolved by skipping KHO for crash kernel. The vulnerability was caused by kho_fill_kimage() unconditionally populating the kimage with KHO metadata for every kexec image type, which can be problematic for crash kernels. This can cause issues as crash kernels run in a small reserved region and the KHO scratch areas can sit outside it, leading to faults during kho_memory_init(). The fix involves adding a guard to kho_fill_kimage() to skip KHO logic for KEXEC_TYPE_CRASH images.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-19
Original CVE updated
2026-07-19
Advisory published
2026-07-19
Advisory updated
2026-07-19

Who should care

Linux kernel developers and users who rely on crash kernels should be aware of this vulnerability and take necessary precautions. This includes reviewing and applying the patch to skip KHO for crash kernel, monitoring Linux kernel updates for further patches, and considering implementing compensating controls for crash kernels. Affected operators, platforms, and security teams should review the official advisory for guidance on affected systems and take steps to mitigate the vulnerability.

Technical summary

The Linux kernel vulnerability CVE-2026-64167 was caused by kho_fill_kimage() unconditionally populating the kimage with KHO metadata for every kexec image type. This can be problematic for crash kernels as they can run in a small reserved region and the KHO scratch areas can sit outside it. The crash kernel then faults during kho_memory_init() when it tries phys_to_virt() on the KHO FDT address. The fix involves adding a guard to kho_fill_kimage() to skip KHO logic for KEXEC_TYPE_CRASH images, which is sufficient for both arm64 and x86.

Defensive priority

Medium

Recommended defensive actions

  • Review and apply the patch to skip KHO for crash kernel
  • Monitor Linux kernel updates for further patches
  • Consider implementing compensating controls for crash kernels
  • Review the official advisory for guidance on affected systems
  • Track exceptions and retest remediated assets
  • Check relevant monitoring, detection, and logs for exposed assets
  • Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record was published on 2026-07-19T16:17:58.833Z and has not been modified since then. The NVD entry is currently Received. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the official advisory. The vulnerability affects Linux kernel deployments, and defenders should review the official advisory for guidance on affected systems.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-19T16:17:58.833Z and has not been modified since then.