CVE-2025-39817

What it actually does

Out-of-bounds memory access during dentry name comparison in efivarfs when d_name.len is shorter than EFI_VARIABLE_GUID_LEN, allowing negative offset in memcmp within efivarfs_d_compare during RCU lookup.

Why it matters to the business

Local users on affected Linux systems may trigger kernel crashes or memory corruption through crafted file operations on efivarfs, leading to denial of service and potential information exposure in environments relying on EFI variables.

How an attack unfolds

An attacker performs parallel open or lookup operations using invalid short filenames in the efivarfs mount, causing an invalid dentry to be added to the hash list and later retrieved during d_compare, resulting in slab-out-of-bounds access.

How to fix it

Update the Linux kernel to a version containing commit 0f63fbabeaaaaaaf5b742a2f4c1b4590d50bf1f6 or later; for Debian packages apply xgalaga 2.0.34-22 or equivalent kernel updates that include the efivarfs_d_compare length check before comparison.

How to confirm the fix worked

Verify kernel source contains the added length check for guid before memcmp in efivarfs_d_compare; test by attempting parallel lookups with short invalid filenames and confirm absence of KASAN slab-out-of-bounds reports.

Typical attack path

1. Mount or access efivarfs filesystem
2. Trigger parallel lookup_open calls with filenames shorter than EFI_VARIABLE_GUID_LEN
3. Force d_alloc_parallel and __d_lookup_rcu to retrieve the invalid dentry
4. Invoke efivarfs_d_compare leading to negative guid offset and OOB memcmp

How to detect it

Review kernel logs for KASAN slab-out-of-bounds reports involving efivarfs_d_compare or memcmp during path_openat; inspect audit logs for unusual parallel openat calls targeting efivarfs entries.

What your security team should do

• Prioritize kernel updates on systems exposing efivarfs to unprivileged users
• Audit for custom efivarfs usage and restrict access where possible
• Monitor for local privilege escalation attempts targeting filesystem lookups