{"id":"CVE-2026-89604","title":"efivarfs: Rate limit statfs() handler","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nefivarfs: Rate limit statfs() handler\n\nRavi reports that statfs() may be called by unprivileged users on the\nefivarfs mount point, which may result in a flood of calls …","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-770"],"vendor":"Linux","product":"Linux","affected":["Linux >= 115409cbb6a296d73702a62c54c5b1b11cb88b3d < 97d71ebee48cd1b29091762b3e5cca4f815dd84c","Linux >= d86ff3333cb1d5f42d8898fb5fdb304e143c0237 < 3cd611c9f1dbcc116c8af5112e3c1783c8cde2ae","Linux >= d86ff3333cb1d5f42d8898fb5fdb304e143c0237 < 8953bdd1b9c0e748d5408d3d0b8e7aeee5c9cd41","Linux >= d86ff3333cb1d5f42d8898fb5fdb304e143c0237 < 92895a14329cc9533e2a74a265214f690ba3851a","Linux >= d86ff3333cb1d5f42d8898fb5fdb304e143c0237 < 0dbc2e94b81df5a1264068b6ed3605c654b8afcb","Linux >= d86ff3333cb1d5f42d8898fb5fdb304e143c0237 < b2326338dc683e8c1067c0cbf7a47986c4190902","Linux >= 6.1.178 < 6.1.188","Linux 6.5"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:49:35.476Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89604","references":[{"url":"https://git.kernel.org/stable/c/97d71ebee48cd1b29091762b3e5cca4f815dd84c"},{"url":"https://git.kernel.org/stable/c/3cd611c9f1dbcc116c8af5112e3c1783c8cde2ae"},{"url":"https://git.kernel.org/stable/c/8953bdd1b9c0e748d5408d3d0b8e7aeee5c9cd41"},{"url":"https://git.kernel.org/stable/c/92895a14329cc9533e2a74a265214f690ba3851a"},{"url":"https://git.kernel.org/stable/c/0dbc2e94b81df5a1264068b6ed3605c654b8afcb"},{"url":"https://git.kernel.org/stable/c/b2326338dc683e8c1067c0cbf7a47986c4190902"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89604.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89604"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532362"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89604"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89604"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89604.mbox"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00211,"epssPercentile":0.11324,"ingestedAt":"2026-09-14T15:23:07.451Z","slug":"CVE-2026-89604","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nefivarfs: Rate limit statfs() handler\n\nRavi reports that statfs() may be called by unprivileged users on the\nefivarfs mount point, which may result in a flood of calls to the\nQueryVariableInfo() runtime service. These calls are disproportionately\ncostly on x86 systems where the variable store is backed by SMM, as each\nSMM entry requires a rendez-vous of all the CPUs.\n\nSo rate limit the calls to QueryVariableInfo() at twice per second, and\nreturn the most recently obtained value for calls that are elided.\n\n## Affected\n\n- `Linux >= 115409cbb6a296d73702a62c54c5b1b11cb88b3d < 97d71ebee48cd1b29091762b3e5cca4f815dd84c`\n- `Linux >= d86ff3333cb1d5f42d8898fb5fdb304e143c0237 < 3cd611c9f1dbcc116c8af5112e3c1783c8cde2ae`\n- `Linux >= d86ff3333cb1d5f42d8898fb5fdb304e143c0237 < 8953bdd1b9c0e748d5408d3d0b8e7aeee5c9cd41`\n- `Linux >= d86ff3333cb1d5f42d8898fb5fdb304e143c0237 < 92895a14329cc9533e2a74a265214f690ba3851a`\n- `Linux >= d86ff3333cb1d5f42d8898fb5fdb304e143c0237 < 0dbc2e94b81df5a1264068b6ed3605c654b8afcb`\n- `Linux >= d86ff3333cb1d5f42d8898fb5fdb304e143c0237 < b2326338dc683e8c1067c0cbf7a47986c4190902`\n- `Linux >= 6.1.178 < 6.1.188`\n- `Linux 6.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89604.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":205483,"id":"CVE-2026-89604","ts":1789576721773,"field":"cvss","old":"4.7","new":"5.5"},{"seq":203988,"id":"CVE-2026-89604","ts":1789490230936,"field":"cvss","old":null,"new":"4.7"},{"seq":203987,"id":"CVE-2026-89604","ts":1789490230936,"field":"severity","old":"none","new":"medium"},{"seq":147347,"id":"CVE-2026-89604","ts":1789270210550,"field":"cvss","old":null,"new":"4.7"},{"seq":147346,"id":"CVE-2026-89604","ts":1789270210550,"field":"severity","old":"none","new":"medium"},{"seq":109082,"id":"CVE-2026-89604","ts":1789183730236,"field":"cvss","old":null,"new":"4.7"},{"seq":109081,"id":"CVE-2026-89604","ts":1789183730236,"field":"severity","old":"none","new":"medium"}]}