The vulnerability arises when the Linux kernel’s kho_fill_kimage() function unconditionally writes KHO metadata for every kexec image, including crash kernels. When a crash kernel runs in a small reserved memory region, the KHO scratch areas can be placed outside that region, leading to a kernel panic during kho_memory_init() as phys_to_virt() attempts to access an unmapped virtual address. This results in an "Unable to handle kernel paging request" crash, effectively denying service and compromising system stability. The weakness is identified as a classic out‑of‑bounds read (CWE‑125).

All Linux kernel installations that support kexec, specifically the arm64 and x86 architectures. The issue exists in versions prior to the patch that adds a guard in kho_fill_kimage() for crash kernels; no specific CVE‑listed versions are provided.

The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of exploitation in the wild. However, based on the description, it is inferred that the flaw can be triggered by a privileged user who initiates a crash kernel via kexec, which is a local attack vector. The exploitation requires the attacker to have permission to execute kexec commands and to load a crash kernel image. Once triggered, the system will crash, preventing further operation until reboot. Given the critical role of crash kernels in system recovery, patching is urgent.