Medium [CVE-2026-6862] Efivar: efivar: denial of service due to stack overflow in device path node parsing
This medium-severity Red Hat Linux advisory covers CVE-2026-6862 affecting Red Hat Hardened Images.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4 bytes, which is the minimum size for an EFI (Extensible Firmware Interface) device path node header.
A local user could exploit this vulnerability by providing a specially crafted device path node. This can lead to infinite recursion, causing stack exhaustion and a process crash, resulting in a denial of service (DoS).
Moderate impact. A stack overflow vulnerability in `libefiboot` (part of `efivar`) can lead to a process crash due to unbounded recursion when parsing a specially crafted device path node.
This flaw affects Red Hat Enterprise Linux 8, 9, and 10, as well as Fedora and OpenShift Container Platform. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
Weakness: CWE-674. Affected Red Hat products: Red Hat Hardened Images.
Red Hat fixing advisory: RHSA-2026:69321.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 20 days ago·verify at source
- efivar-main-39-13.1.hum1
- RHSA-2026:69321
Official advisory · high-confidence parse· fetched 20 days ago·verify at source
Mitigation checklist
- Applications using efi_loadopt_is_valid() should validate the size of the input buffer before passing it to libefiboot. As a library-level fix, the device path iterator should enforce a minimum node Length of 4 before recursing: if (dp->length < 4) return -1;
Official advisory · high-confidence parse· fetched 20 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.