Executive brief
A vulnerability exists in libefiboot, a library used to manage UEFI variables and boot entries on Linux systems. By providing a specially crafted boot device path, a local user can cause the system's boot management tools to crash. This results in a denial of service, preventing users or administrators from modifying or viewing boot configurations.
Technical details
A stack overflow vulnerability exists in libefiboot, a component of the efivar package, specifically within the device path node parser. The root cause is a failure to validate that the 'Length' field of an EFI device path node is at least 4 bytes (the minimum header size) before processing. When a crafted node with a length less than 4 is encountered, the functions efi_loadopt_is_valid() and efi_loadopt_optional_data_size() enter an infinite recursion loop. This leads to stack exhaustion and a process crash. An attacker can trigger this locally by providing a malformed device path node, resulting in a denial of service (DoS).
Affected products
- rhboot efivar unspecified
- rhboot libefiboot unspecified
Timeline
- 2026-04-21: disclosed: Initial report in Red Hat Bugzilla
- 2026-04-22: advisory: CVE-2026-6862 published