CVE-2026-19411: Shim UEFI Bootloader DoS Vulnerability

CVE-2026-19411 Overview

CVE-2026-19411 is a NULL pointer dereference vulnerability in the shim application's dp.c library. The shim application acts as a first-stage Unified Extensible Firmware Interface (UEFI) bootloader used to establish a trusted boot chain on Linux systems. A missing NULL pointer check in dp.c allows a local attacker with high privileges to trigger a denial of service against systems that rely on shim for UEFI boot.

The issue is tracked under CWE-476: NULL Pointer Dereference and is documented in the Red Hat CVE-2026-19411 Advisory.

Critical Impact
Successful exploitation can crash the UEFI boot process, preventing affected systems from booting and disrupting availability of the platform.

Affected Products

shim UEFI bootloader application (dp.c library component)
Linux distributions that ship shim for Secure Boot chain-of-trust
Red Hat Enterprise Linux systems tracked under Red Hat Bug Report #2513060

Discovery Timeline

2026-08-10 - CVE-2026-19411 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-19411

Vulnerability Analysis

The vulnerability resides in dp.c, a source file within the shim project responsible for handling UEFI device path structures. The code path fails to validate a pointer before dereferencing it, resulting in a NULL pointer dereference when the referenced object is absent. The flaw is exploitable only from a local context and requires high privileges, which limits its reachable attacker population but still exposes multi-tenant, kiosk, and shared-boot environments to denial of service.

Because shim runs as part of the UEFI boot chain, a crash inside the loader halts platform initialization before the operating system kernel executes. Recovery typically requires physical access, firmware-level intervention, or restoration of a known-good boot configuration.

Root Cause

The root cause is a missing NULL check preceding a pointer dereference in the device path handling logic in dp.c. When shim processes a malformed or unexpected device path, control flow reaches code that assumes a non-NULL pointer, producing an immediate fault in the UEFI runtime.

Attack Vector

Exploitation requires local access and elevated privileges on the target system. An attacker who can influence boot-time inputs, such as EFI variables or boot configuration data consumed by shim, can craft input that triggers the NULL dereference. The result is a denial of service against the boot process. The vulnerability does not grant code execution and does not directly disclose sensitive data.

No verified public proof-of-concept code is available. See the Red Hat CVE-2026-19411 Advisory for authoritative technical detail.

Detection Methods for CVE-2026-19411

Indicators of Compromise

Unexpected boot failures on systems that use shim for UEFI Secure Boot, particularly repeat failures on the same hardware
UEFI firmware logs referencing faults in the shim binary during Boot Services execution
Modifications to EFI variables or BootOrder entries by local privileged users preceding a boot failure

Detection Strategies

Monitor privileged process activity that writes to /sys/firmware/efi/efivars/ or invokes efibootmgr with modifications to boot entries
Correlate audit records from auditd for changes to the ESP (EFI System Partition) with subsequent reboots and boot failures
Track deployed shim package versions across the fleet and alert on hosts running unpatched builds identified in the Red Hat CVE-2026-19411 Advisory

Monitoring Recommendations

Enable centralized logging of firmware and pre-boot events where the hardware supports it
Track boot success and failure metrics per host and alert on anomalous clustering
Review privileged user sessions that precede boot-time faults for lateral or persistence activity

How to Mitigate CVE-2026-19411

Immediate Actions Required

Apply the shim package update from your Linux distribution as soon as it is available; consult the Red Hat CVE-2026-19411 Advisory for Red Hat builds
Inventory hosts that use shim for UEFI Secure Boot and prioritize systems where local privileged access is broadly available
Restrict local administrative privileges to reduce the population of accounts that can reach the vulnerable code path

Patch Information

Refer to distribution advisories for fixed shim package versions. The Red Hat CVE-2026-19411 Advisory and Red Hat Bug Report #2513060 track the fix state for Red Hat Enterprise Linux. Rebuild any custom shim binaries against the patched source once upstream commits land.

Workarounds

Enforce least privilege and remove unnecessary root or sudo grants that would allow an attacker to reach boot configuration surfaces
Enable and monitor UEFI Secure Boot policy enforcement so that unauthorized changes to boot components are detected
Maintain tested recovery media and documented UEFI recovery procedures to reduce downtime if a boot failure occurs

bash

# Verify installed shim version on Red Hat-based systems
rpm -q shim-x64

# List current UEFI boot entries to detect unauthorized modification
efibootmgr -v

# Restrict write access to EFI variables to root only
ls -l /sys/firmware/efi/efivars/