Executive brief
The efivarfs filesystem in the Linux kernel is used by systems to access UEFI firmware variables. An unprivileged user can repeatedly call the statfs() function on an efivarfs mount point, flooding expensive firmware calls that cause all CPU cores to synchronize. This can cause temporary system slowdowns or resource exhaustion. A rate-limiting fix caps these calls to twice per second.
Technical details
The vulnerability is a denial-of-service condition in the efivarfs_statfs() handler. When unprivileged users call statfs() on an efivarfs mount, it invokes the QueryVariableInfo() UEFI runtime service without rate limiting. On x86 systems where the variable store is SMM-backed, each call requires a CPU rendezvous across all cores, making them disproportionately expensive. An attacker can flood these calls to degrade performance. The fix introduces a per-second rate limit (2 HZ, 5 burst) using kernel rate-limit primitives, caching query results and returning cached values for requests exceeding the limit. The vulnerability affects any Linux system with efivarfs exposed to unprivileged users and an SMM-backed UEFI variable store.
Affected products
- Linux Linux kernel affected versions with efivarfs support prior to this patch
Timeline
- 2026-09-11: disclosed: CVE published
- 2026-09-07: patched: Patch committed to stable kernel
- 2026-08-01: other: Fix authored by Ard Biesheuvel