CVE-2026-89604 (GCVE-0-2026-89604)
Vulnerability from cvelistv5
Published
2026-09-11 19:45
Modified
2026-10-19 08:49
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: efivarfs: Rate limit statfs() handler Ravi reports that statfs() may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls to the QueryVariableInfo() runtime service. These calls are disproportionately costly on x86 systems where the variable store is backed by SMM, as each SMM entry requires a rendez-vous of all the CPUs. So rate limit the calls to QueryVariableInfo() at twice per second, and return the most recently obtained value for calls that are elided.
References
Impacted products
Vendor Product Version
Linux Linux Version: 115409cbb6a296d73702a62c54c5b1b11cb88b3d
Version: d86ff3333cb1d5f42d8898fb5fdb304e143c0237
Version: d86ff3333cb1d5f42d8898fb5fdb304e143c0237
Version: d86ff3333cb1d5f42d8898fb5fdb304e143c0237
Version: d86ff3333cb1d5f42d8898fb5fdb304e143c0237
Version: d86ff3333cb1d5f42d8898fb5fdb304e143c0237
Version: 6.1.178   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/efivarfs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "97d71ebee48cd1b29091762b3e5cca4f815dd84c",
              "status": "affected",
              "version": "115409cbb6a296d73702a62c54c5b1b11cb88b3d",
              "versionType": "git"
            },
            {
              "lessThan": "3cd611c9f1dbcc116c8af5112e3c1783c8cde2ae",
              "status": "affected",
              "version": "d86ff3333cb1d5f42d8898fb5fdb304e143c0237",
              "versionType": "git"
            },
            {
              "lessThan": "8953bdd1b9c0e748d5408d3d0b8e7aeee5c9cd41",
              "status": "affected",
              "version": "d86ff3333cb1d5f42d8898fb5fdb304e143c0237",
              "versionType": "git"
            },
            {
              "lessThan": "92895a14329cc9533e2a74a265214f690ba3851a",
              "status": "affected",
              "version": "d86ff3333cb1d5f42d8898fb5fdb304e143c0237",
              "versionType": "git"
            },
            {
              "lessThan": "0dbc2e94b81df5a1264068b6ed3605c654b8afcb",
              "status": "affected",
              "version": "d86ff3333cb1d5f42d8898fb5fdb304e143c0237",
              "versionType": "git"
            },
            {
              "lessThan": "b2326338dc683e8c1067c0cbf7a47986c4190902",
              "status": "affected",
              "version": "d86ff3333cb1d5f42d8898fb5fdb304e143c0237",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.188",
              "status": "affected",
              "version": "6.1.178",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/efivarfs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "6.1.178",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nefivarfs: Rate limit statfs() handler\n\nRavi reports that statfs() may be called by unprivileged users on the\nefivarfs mount point, which may result in a flood of calls to the\nQueryVariableInfo() runtime service. These calls are disproportionately\ncostly on x86 systems where the variable store is backed by SMM, as each\nSMM entry requires a rendez-vous of all the CPUs.\n\nSo rate limit the calls to QueryVariableInfo() at twice per second, and\nreturn the most recently obtained value for calls that are elided."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:49:35.476Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/97d71ebee48cd1b29091762b3e5cca4f815dd84c"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cd611c9f1dbcc116c8af5112e3c1783c8cde2ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/8953bdd1b9c0e748d5408d3d0b8e7aeee5c9cd41"
        },
        {
          "url": "https://git.kernel.org/stable/c/92895a14329cc9533e2a74a265214f690ba3851a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0dbc2e94b81df5a1264068b6ed3605c654b8afcb"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2326338dc683e8c1067c0cbf7a47986c4190902"
        }
      ],
      "title": "efivarfs: Rate limit statfs() handler",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89604",
    "datePublished": "2026-09-11T19:45:07.365Z",
    "dateReserved": "2026-09-11T19:38:34.733Z",
    "dateUpdated": "2026-10-19T08:49:35.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.