CVE-2026-89604

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

efivarfs: Rate limit statfs() handler

Ravi reports that statfs() may be called by unprivileged users on the

efivarfs mount point, which may result in a flood of calls to the

QueryVariableInfo() runtime service. These calls are disproportionately

costly on x86 systems where the variable store is backed by SMM, as each

SMM entry requires a rendez-vous of all the CPUs.

So rate limit the calls to QueryVariableInfo() at twice per second, and

return the most recently obtained value for calls that are elided.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References