diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc
index af3576d..ba8e467 100644
--- a/meta/recipes-kernel/linux/cve-exclusion.inc
+++ b/meta/recipes-kernel/linux/cve-exclusion.inc
@@ -206,3 +206,11 @@ host model, no upstream kernel fix, mitigated by firewall configuration"
 # https://security-tracker.debian.org/tracker/CVE-2021-3714
 CVE_STATUS[CVE-2021-3714] = "unpatched: timing side channel inherent to \
 KSM page deduplication, only reachable when KSM is enabled and opted into"
+
+# Two mitigation attempts, neither merged; the fs/exec.c logic is
+# unchanged. An absolute, piped or socket kernel.core_pattern (for
+# example systemd-coredump) prevents exploitation.
+# https://www.openwall.com/lists/oss-security/2021/10/20/2
+# https://ubuntu.com/security/CVE-2021-3864
+CVE_STATUS[CVE-2021-3864] = "unpatched: no accepted mainline fix, \
+exploitation requires a relative kernel.core_pattern"