SB20260912175 - Resource exhaustion in Linux kernel efivarfs

Description

This security bulletin contains information about 1 vulnerability.

1) Resource exhaustion (CVE-ID: CVE-2026-89604)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the efivarfs statfs() handler when repeatedly invoking statfs() on the efivarfs mount point. A local user can flood the QueryVariableInfo() runtime service with statfs() calls to cause a denial of service.

On x86 systems with a variable store backed by SMM, each runtime-service entry requires a rendezvous of all CPUs.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0dbc2e94b81df5a1264068b6ed3605c654b8afcb
• https://git.kernel.org/stable/c/8953bdd1b9c0e748d5408d3d0b8e7aeee5c9cd41
• https://git.kernel.org/stable/c/92895a14329cc9533e2a74a265214f690ba3851a
• https://git.kernel.org/stable/c/b2326338dc683e8c1067c0cbf7a47986c4190902