CVE-2025-39817

Vulnerability

Details

CVE-2025-39817 is a slab-out-of-bounds read vulnerability in the efivarfs_d_compare function of the Linux kernel's efivarfs filesystem. The root cause is an incorrect calculation of the guid offset when the dentry name length is less than EFI_VARIABLE_GUID_LEN, resulting in a negative offset that leads to an out-of-bounds memory access via memcmp [1]. This was discovered through Kernel Address Sanitizer (KASAN) reports on kernel 6.6 and later confirmed on the mainline kernel.

Exploitation

The vulnerability can be exploited by an attacker with local access to the system. The attack involves performing parallel lookup operations on the efivarfs filesystem (typically mounted at /sys/firmware/efi/efivars) using specially crafted filenames that are shorter than the expected GUID length. A race condition between two concurrent lookup operations can cause an invalid dentry to be added to the directory hash list. When a subsequent lookup retrieves this dentry and calls efivarfs_d_compare, the out-of-bounds read occurs [1]. No special privileges beyond local access are required, making this a low-complexity attack.

Impact

Successful exploitation allows an attacker to read kernel memory beyond the intended bounds, potentially leaking sensitive information. The out-of-bounds read can also cause a kernel panic, leading to a denial of service. The CVSS v3 score of 7.1 (High) reflects the potential for confidentiality impact and system availability disruption.

Mitigation

The fix has been applied to the Linux kernel stable branches. The commits identified by [2], [3], and [4] address the issue by adding a check on the guid value before performing the comparison. Users should update their kernels to the latest stable version that includes these patches. The Siemens advisory [1] lists this CVE among affected products, indicating that embedded systems using the kernel may also require patching.