Executive brief
A vulnerability in the Linux kernel's Kexec Handover (KHO) mechanism could cause a system to crash when attempting to load a recovery kernel. This occurs because the system incorrectly tries to access memory regions that are not available to the crash recovery environment. While this primarily affects system reliability during a failure, it could hinder automated recovery processes or lead to a denial-of-service state.
Technical details
A null pointer dereference or invalid memory access occurs in the Linux kernel's KHO (Kexec Handover) implementation. The function `kho_fill_kimage()` unconditionally populates kimage metadata for all kexec types, including `KEXEC_TYPE_CRASH`. Because crash kernels often operate within restricted, small reserved memory regions, the KHO scratch areas may reside outside accessible bounds. This causes a page fault in `kho_memory_init()` when `phys_to_virt()` is called on the KHO Flattened Device Tree (FDT) address. The fix introduces a guard to skip KHO logic for crash kernel images.
Affected products
- Linux Linux 6.19, 7.0.11
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory