CVE-2026-89604

A flaw was found in the Linux kernel's efivarfs component. An unprivileged local user can exploit this by repeatedly calling the statfs() handler on the efivarfs mount point. This action triggers a flood of calls to the QueryVariableInfo() runtime service, which is particularly costly on x86 systems. The excessive calls can lead to significant performance degradation, potentially resulting in a Denial of Service (DoS).

A low impact local denial of service flaw was found in the Linux kernel's efivarfs filesystem. An unprivileged local user can repeatedly call statfs() on an efivarfs mount point, causing a flood of calls to the QueryVariableInfo() EFI runtime service. On x86 systems where the EFI variable store is backed by SMM, each call requires a rendezvous of all CPUs, making this flood disproportionately costly and capable of causing significant system-wide performance degradation or denial of service. Confidentiality and integrity are not affected. Affected Red Hat products include Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt), Red Hat In-Vehicle Operating System (RHIVOS) kernel streams, and OpenShift releases based on RHEL CoreOS 9 (OpenShift 4.19 and later). Red Hat Enterprise Linux 6, 7, and 8, the RHEL 9.2 and 9.4 kernel streams, and OpenShift 4.12 through 4.18 are not affected because the vulnerable code is not present in those streams. Fixes for the affected streams are deferred because the flaw is of moderate severity with a CVSS 3.1 base score of 5.5, below 7.0, the threshold at which Red Hat files trackers for moderate severity flaws. The residual risk is that an unprivileged local user on an affected x86 system whose EFI variable store is backed by SMM can degrade system performance or make the system unresponsive until a fix is delivered.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.