PT-2025-37962 · Linux+7 · Linux Kernel+7
Published
2025-01-01
·
Updated
2026-05-07
·
CVE-2025-39817
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6
Description
The Linux kernel contains a flaw in the efivarfs module related to an out-of-bounds write in the
efivarfs d compare function. This issue occurs when dentry->d name.len is less than EFI VARIABLE GUID LEN, potentially leading to out-of-bounds access. The vulnerability can be triggered by parallel lookups using an invalid filename. Specifically, the issue arises during directory comparison within the efivarfs d compare function when handling invalid dentries added to the hash list.Recommendations
Update to a newer kernel version to address this issue.
Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Centos
Debian
Linuxmint
Linux Kernel
Red Hat
Rocky Linux
Ubuntu