CVE-2026-89604: efivarfs: Rate limit statfs() handler
efivarfs: Rate limit statfs() handler
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Rate-limit efivarfs statfs() calls to the QueryVariableInfo() runtime service to twice per second, and return the most recently obtained value for calls that are elided.
Event History
Frequently Asked Questions
Who can trigger the costly firmware calls?
Unprivileged users that can call statfs() on the efivarfs mount point can trigger the behavior. The impact is especially significant on x86 systems whose EFI variable store is backed by SMM.
Why are affected x86 systems more vulnerable to resource exhaustion?
Each QueryVariableInfo() runtime-service call can require an SMM entry, and each SMM entry requires a rendezvous of all CPUs. A flood of statfs() calls can therefore impose disproportionate system-wide overhead.
What changes with the fix?
QueryVariableInfo() calls from the efivarfs statfs() handler are limited to twice per second. Calls suppressed by the rate limit receive the most recently obtained value instead.