Methods, systems, and computer program products are included for collecting kernel data in a protected kernel environment. A method includes allocating a first portion of a memory for a first kernel and reserving a second portion of the memory for a second kernel. The second kernel is stored in the second portion of the memory. A hypervisor is provided a memory address corresponding to the second portion of the memory. The hypervisor disables write and execute access privileges corresponding to the second portion of the memory. After a crash occurs corresponding to the first kernel, the second kernel is attempted to be executed. The hypervisor detects the attempted execution of the second kernel. The hypervisor enables execute access privileges corresponding to the second portion of the memory. After the execute access privileges are enabled, the second kernel is executed to collect data corresponding to the first kernel.