Linux kernel efivarfs: unprivileged statfs() floods the UEFI QueryVariableInfo runtime service

Impact

statfs() on the efivarfs mount point is callable by any unprivileged user and each call reaches the UEFI QueryVariableInfo() runtime service. On x86 systems whose variable store is backed by SMM, every call forces an SMM entry, which requires a rendez-vous of all CPUs on the socket. A local user looping on statfs() therefore stalls every core on the machine from firmware, not from the scheduler - on a GPU node that shows up as unexplained jitter and stalled training steps that no cgroup or CPU limit constrains. The fix rate-limits the runtime service call to twice per second and returns the cached value in between.

Who can reach it

Any local unprivileged user on a host where efivarfs is mounted (the default on UEFI systems), including a tenant in a container that has the host efivarfs visible. No authentication beyond shell access.

What to do

Patch the host kernel to a stable release adding the rate limit to the efivarfs statfs handler (commits below) and reboot the node. As an immediate mitigation, unmount efivarfs or keep it out of tenant mount namespaces on nodes where firmware variable access is not needed at runtime. No vendor fixed-version string appears in the record beyond the stable commits.

References

Related entries

• Linux CephFS client: unchecked dentry name length overflows a NAME_MAX buffer in the NFS re-export pathCVE-2026-89652 · Linux kernel CephFS client (ceph_get_name / __get_snap_name, NFS-export path)Unscored
• Linux CephFS client: out-of-range MDS rank in mdsmap export_targets writes past a stack bitmapCVE-2026-89653 · Linux kernel CephFS client (mdsmap decode, export_targets rank validation)Unscored
• Linux CephFS client: use-after-free on an MDS session freed while check_new_map drops mdsc->mutexCVE-2026-89654 · Linux kernel CephFS client (check_new_map, MDS session refcounting)Unscored
• Linux CephFS client: use-after-free when a cap-flush entry is freed by a fast FLUSH_ACK mid-iterationCVE-2026-89655 · Linux kernel CephFS client (__kick_flushing_caps, cap flush list iteration)Unscored
• Linux libceph: malformed CRUSH map aliases bucket workspaces and overflows the permutation bufferCVE-2026-89656 · Linux kernel libceph (crush_decode, bucket id vs array slot validation)Unscored
• Linux libceph: malformed OSD sparse-read reply advances the message cursor past the request buffer and panicsCVE-2026-89657 · Linux kernel libceph (osd_sparse_read, sparse extent map validation)Unscored