Bug 2395805 (CVE-2025-39817)

Summary: CVE-2025-39817 kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A slab-out-of-bounds exists in the linux kernel in efivarfs_d_compare, such that the issue can be triggered by parallel lookups using an invalid filename due to an incorrect memcmp function.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-09-16 14:03:45 UTC
In the Linux kernel, the following vulnerability has been resolved:

efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare

Observed on kernel 6.6 (present on master as well):

  BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0
  Call trace:
   kasan_check_range+0xe8/0x190
   __asan_loadN+0x1c/0x28
   memcmp+0x98/0xd0
   efivarfs_d_compare+0x68/0xd8
   __d_lookup_rcu_op_compare+0x178/0x218
   __d_lookup_rcu+0x1f8/0x228
   d_alloc_parallel+0x150/0x648
   lookup_open.isra.0+0x5f0/0x8d0
   open_last_lookups+0x264/0x828
   path_openat+0x130/0x3f8
   do_filp_open+0x114/0x248
   do_sys_openat2+0x340/0x3c0
   __arm64_sys_openat+0x120/0x1a0

If dentry->d_name.len < EFI_VARIABLE_GUID_LEN , 'guid' can become
negative, leadings to oob. The issue can be triggered by parallel
lookups using invalid filename:

  T1			T2
  lookup_open
   ->lookup
    simple_lookup
     d_add
     // invalid dentry is added to hash list

			lookup_open
			 d_alloc_parallel
			  __d_lookup_rcu
			   __d_lookup_rcu_op_compare
			    hlist_bl_for_each_entry_rcu
			    // invalid dentry can be retrieved
			     ->d_compare
			      efivarfs_d_compare
			      // oob

Fix it by checking 'guid' before cmp.

Comment 3 errata-xmlrpc 2025-10-20 02:00:41 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:18281 https://access.redhat.com/errata/RHSA-2025:18281

Comment 4 errata-xmlrpc 2025-10-20 09:49:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:18318 https://access.redhat.com/errata/RHSA-2025:18318

Comment 5 errata-xmlrpc 2025-10-27 09:36:12 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:19103 https://access.redhat.com/errata/RHSA-2025:19103

Comment 6 errata-xmlrpc 2025-10-27 09:38:16 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:19102 https://access.redhat.com/errata/RHSA-2025:19102

Comment 7 errata-xmlrpc 2025-11-12 11:25:14 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:21112 https://access.redhat.com/errata/RHSA-2025:21112

Comment 8 errata-xmlrpc 2025-11-12 12:22:15 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:21118 https://access.redhat.com/errata/RHSA-2025:21118

Comment 10 errata-xmlrpc 2025-11-19 12:27:26 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:21760 https://access.redhat.com/errata/RHSA-2025:21760

Comment 14 errata-xmlrpc 2025-11-25 10:35:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:22066 https://access.redhat.com/errata/RHSA-2025:22066

Comment 15 errata-xmlrpc 2025-11-25 12:31:16 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:22072 https://access.redhat.com/errata/RHSA-2025:22072

Comment 16 errata-xmlrpc 2025-11-25 16:04:53 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:22087 https://access.redhat.com/errata/RHSA-2025:22087

Comment 17 errata-xmlrpc 2025-11-25 17:16:09 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:22095 https://access.redhat.com/errata/RHSA-2025:22095

Comment 18 errata-xmlrpc 2025-11-25 18:13:54 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:22124 https://access.redhat.com/errata/RHSA-2025:22124

Comment 20 errata-xmlrpc 2025-12-17 07:45:28 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2025:23445 https://access.redhat.com/errata/RHSA-2025:23445

Comment 21 errata-xmlrpc 2026-01-14 00:13:38 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:0533 https://access.redhat.com/errata/RHSA-2026:0533