CVE-2026-6862: Efivar: efivar: denial of service due to stack overflow in device path node parsing
A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4 bytes, which is the minimum size for an EFI (Extensible Firmware Interface) device path node header. A local user could exploit this vulnerability by providing a specially crafted device path node. This can lead to infinite recursion, causing stack exhaustion and a process crash, resulting in a denial of service (DoS).
Other sources
A stack overflow vulnerability was found in libefiboot (part of efivar). The device path node parser does not validate that each node Length field is >= 4 bytes (minimum EFI device path node header size) before recursing. A crafted node with Length < 4 causes infinite recursion in efiloadoptisvalid() -> efiloadoptoptionaldatasize(), leading to stack exhaustion and process crash.
Upstream: github.com/rhboot/efivar - no Issues tab or SECURITY.md available. This report serves as initial upstream notification. Suggested fix: Add minimum length guard: if (dp->length < 4) return -1;
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6862?
CVE-2026-6862 is classified as a denial of service vulnerability due to a stack overflow in device path node parsing.
How do I fix CVE-2026-6862?
To fix CVE-2026-6862, update your installation of libefiboot to the latest version provided by your vendor.
Who is affected by CVE-2026-6862?
CVE-2026-6862 affects systems using the libefiboot component of efivar, including distributions like Red Hat and Ubuntu.
What type of attack does CVE-2026-6862 enable?
CVE-2026-6862 enables denial of service attacks by causing the application to crash due to stack overflow.
Is CVE-2026-6862 easy to exploit?
The exploitation of CVE-2026-6862 may vary in complexity depending on the context but generally requires crafting a specific device path node.