Linux Kernel CVE-2026-64167

The Linux kernel's KHO (Kexec Handover) subsystem preserves kernel state across kexec reboots by populating kimage structures with FDT (Flattened Device Tree) metadata and scratch memory areas. The vulnerable function kho_fill_kimage() did not distinguish between standard kexec images and crash (kdump) images of type KEXEC_TYPE_CRASH, unconditionally writing image->kho.fdt and image->kho.scratch for all image types. Crash kernels boot within a tightly bounded physical memory reservation declared via the crashkernel= parameter; KHO scratch allocations may reside outside this region. When the crash kernel's kho_memory_init() calls phys_to_virt() on the KHO FDT address, the physical address is not mapped into the crash kernel's reduced virtual address space, producing an unhandled kernel paging fault. Crucially, kho_locate_mem_hole() already contained the KEXEC_TYPE_CRASH guard, but kho_fill_kimage() - the sole point that sets these fields - was missing the equivalent check. CWE-476 is applied, though the fault is technically an invalid virtual address from a bad physical-to-virtual translation rather than a strict null pointer dereference. Affected CPE: cpe:2.3:a:linux:linux:* across multiple stable branches including 6.19 and pre-patch 7.x series.