The Linux kernel vulnerability (CVE-2026-64167) involves the kho_fill_kimage() function unconditionally populating the kimage with KHO metadata for all kexec image types, including crash kernels. Crash kernels operate in a small reserved memory region, but the KHO scratch areas may reside outside this region, leading to faults during kho_memory_init() when phys_to_virt() is called on the KHO FDT address. Although kho_locate_mem_hole() already skipped KHO logic for crash kernels, kho_fill_kimage() lacked this guard. The fix adds the necessary check in kho_fill_kimage(), preventing invalid memory references during crash kernel initialization on arm64 and x86 architectures.

This vulnerability can cause a crash kernel to fault during initialization, resulting in a denial of service (DoS) condition. There is no impact on confidentiality or integrity. The CVSS score is 5.5 (medium severity) with an attack vector of local access, low complexity, and low privileges required.

A fix has been implemented in the Linux kernel source to add a guard in kho_fill_kimage() to skip KHO population for crash kernel images. Users should apply the official kernel updates that include this patch. Since no explicit patch links or vendor advisory are provided, check the Linux kernel mailing lists or distribution security advisories for the relevant fixed kernel versions. No additional mitigations are indicated.