OESA-2026-4839: efivar security update
Some command line interface of the UEFI variables tools are offered by . Security Fix(es):
A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4 bytes, which is the minimum size for an EFI (Extensible Firmware Interface) device path node header. A local user could exploit this vulnerability by providing a specially crafted device path node. This can lead to infinite recursion, causing stack exhaustion and a process crash, resulting in a denial of service (DoS).(CVE-2026-6862)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/efivarto a version that resolves this vulnerability.Fixed in 38-9.oe2403sp1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the affected openEuler efivar package are exposed when a local user can invoke the vulnerable UEFI variable tooling or otherwise supply a crafted device path node to libefiboot.
What does an attacker need to exploit it?
Exploitation requires local access and user interaction. The attacker must provide a specially crafted EFI device path node whose Length field is smaller than the required 4-byte node header.
What is the impact of successful exploitation?
The malformed node can trigger infinite recursion in the device path parser, exhausting stack space and crashing the affected process. The described impact is denial of service; no confidentiality or integrity impact is stated.
How can I tell whether a crash may be related to this issue?
Investigate crashes in efivar or libefiboot processing that occur after handling externally supplied or malformed EFI device path data. The reported failure mechanism is infinite recursion leading to stack exhaustion.