CVE-2026-89604: efivarfs: Rate limit statfs() handler
In the Linux kernel, the following vulnerability has been resolved:
efivarfs: Rate limit statfs() handler
Ravi reports that statfs() may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls to the QueryVariableInfo() runtime service. These calls are disproportionately costly on x86 systems where the variable store is backed by SMM, as each SMM entry requires a rendez-vous of all the CPUs.
So rate limit the calls to QueryVariableInfo() at twice per second, and return the most recently obtained value for calls that are elided.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Rate limit the efivarfs statfs() handler’s underlying QueryVariableInfo() calls to twice per second, and for any elided calls return the most recently obtained value.
efivarfs Rate limit statfs() handler for QueryVariableInfo() = 2 calls per second
Event History
Frequently Asked Questions
Who can trigger the costly firmware calls?
Unprivileged users that can call statfs() on the efivarfs mount point can trigger the behavior. The impact is especially significant on x86 systems whose EFI variable store is backed by SMM.
Why are affected x86 systems more vulnerable to resource exhaustion?
Each QueryVariableInfo() runtime-service call can require an SMM entry, and each SMM entry requires a rendezvous of all CPUs. A flood of statfs() calls can therefore impose disproportionate system-wide overhead.
What changes with the fix?
QueryVariableInfo() calls from the efivarfs statfs() handler are limited to twice per second. Calls suppressed by the rate limit receive the most recently obtained value instead.