CVE-2025-39817: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-39817 Overview

CVE-2025-39817 is an out-of-bounds read vulnerability in the Linux kernel's efivarfs filesystem, specifically in the efivarfs_d_compare function. The flaw was observed on kernel 6.6 and was also present on the mainline branch at the time of the fix. When a dentry name is shorter than EFI_VARIABLE_GUID_LEN, an internal guid length calculation can become negative, producing an out-of-bounds memcmp read that KASAN flags as a slab-out-of-bounds access. A local user can trigger the condition through parallel filesystem lookups using invalid filenames under the EFI variables filesystem.

Critical Impact
A local, authenticated user can trigger a kernel out-of-bounds read via efivarfs, resulting in kernel memory corruption exposure and denial of service on affected Linux systems.

Affected Products

Linux Kernel (multiple stable branches, including 6.6 and 6.17-rc1 through 6.17-rc3)
Debian Linux 11.0
Siemens products bundling affected Linux kernel versions (per Siemens advisory SSA-032379)

Discovery Timeline

2025-09-16 - CVE-2025-39817 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-39817

Vulnerability Analysis

The vulnerability resides in the efivarfs_d_compare dentry comparison routine used by the EFI variables filesystem. The function assumes that any dentry name it receives has at least EFI_VARIABLE_GUID_LEN bytes reserved for a trailing GUID. It computes the GUID offset by subtracting EFI_VARIABLE_GUID_LEN from dentry->d_name.len. When the length is smaller than that constant, the resulting guid value becomes negative, and the subsequent memcmp reads memory outside the intended slab allocation. KASAN captures this as slab-out-of-bounds in memcmp inside __d_lookup_rcu_op_compare during d_alloc_parallel. The vulnerability is classified under [CWE-125] (Out-of-Bounds Read).

Root Cause

The root cause is missing input validation on the dentry name length before performing pointer arithmetic. efivarfs_d_compare did not verify that dentry->d_name.len >= EFI_VARIABLE_GUID_LEN before computing the GUID offset. An invalid dentry created via simple_lookup and inserted into the dcache hash list could later be retrieved by a parallel lookup, which then compares memory outside the allocation. The fix validates the computed guid value before invoking memcmp.

Attack Vector

Exploitation requires local access with permission to open paths under the efivarfs mount, typically /sys/firmware/efi/efivars/. An attacker races two threads performing openat calls with invalid filenames. Thread T1 completes lookup_open and inserts an undersized invalid dentry into the hash list through simple_lookup and d_add. Thread T2 then reaches d_alloc_parallel, walks the hash list with hlist_bl_for_each_entry_rcu, and invokes efivarfs_d_compare on the invalid dentry, producing the out-of-bounds read. No user interaction is required beyond the local privilege to access the mount.

No public proof-of-concept exploit code is available. The technical details of the fix are described in the upstream kernel commits referenced in the Linux kernel stable tree.

Detection Methods for CVE-2025-39817

Indicators of Compromise

Kernel log entries containing BUG: KASAN: slab-out-of-bounds in memcmp with a call stack referencing efivarfs_d_compare and __d_lookup_rcu_op_compare.
Unexpected kernel oops, panics, or task hangs originating from openat syscalls against paths under /sys/firmware/efi/efivars/.
Unprivileged processes issuing high-frequency openat calls with malformed short filenames to the efivarfs mount.

Detection Strategies

Monitor dmesg and journalctl -k output for KASAN reports and stack traces that include efivarfs_d_compare.
Correlate syscall auditing (auditd with rules on openat targeting efivarfs) with process telemetry to identify anomalous access patterns.
Track running kernel versions across the fleet using inventory data and flag hosts that still run vulnerable stable branches.

Monitoring Recommendations

Ingest kernel ring buffer logs into a centralized SIEM or data lake to preserve KASAN traces that would otherwise be lost on reboot.
Alert on repeated openat failures against /sys/firmware/efi/efivars/ from non-root or non-firmware-management processes.
Baseline expected access to efivarfs (typically limited to efibootmgr, fwupd, and administrative tools) and flag deviations.

How to Mitigate CVE-2025-39817

Immediate Actions Required

Apply the vendor kernel update from your Linux distribution as soon as it is available for your branch.
Prioritize patching multi-user systems, shared build hosts, and any Linux endpoints where untrusted local users have shell access.
Restrict local shell access on systems that cannot be patched immediately to reduce the population of potential attackers.

Patch Information

The fix has landed in the mainline Linux kernel and is backported across stable branches. Merged fixes are tracked in the following commits: 0f63fbabeaaa, 568e7761279b, 71581a82f38e, 794399019301, 925599eba460, a6358f8cf648, c2925cd62070, and d7f5e35e7050. Distribution updates are available via the Debian LTS Announcement and the Siemens Security Advisory SSA-032379. Rebuild or install the patched kernel package, then reboot to activate the fixed image.

Workarounds

Unmount efivarfs on systems that do not require EFI variable access at runtime using umount /sys/firmware/efi/efivars.
Restrict access to /sys/firmware/efi/efivars/ through mandatory access control policies such as SELinux or AppArmor to block unprivileged users.
Disable CONFIG_EFI_VARS_FS at kernel build time on custom kernels where EFI variable exposure is not required.

bash

# Example: temporarily unmount efivarfs and confirm it is gone
sudo umount /sys/firmware/efi/efivars
mount | grep efivarfs || echo "efivarfs not mounted"

# Verify running kernel version after applying vendor patch
uname -r