CVE-2025-39817

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6

Description The Linux kernel contains a flaw in the efivarfs module related to an out-of-bounds write in the efivarfs d compare function. This issue occurs when dentry->d name.len is less than EFI VARIABLE GUID LEN, potentially leading to out-of-bounds access. The vulnerability can be triggered by parallel lookups using an invalid filename. Specifically, the issue arises during directory comparison within the efivarfs d compare function when handling invalid dentries added to the hash list.

Recommendations Update to a newer kernel version to address this issue.