CVE-2025-39817

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare<br /> <br /> Observed on kernel 6.6 (present on master as well):<br /> <br /> BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0<br /> Call trace:<br /> kasan_check_range+0xe8/0x190<br /> __asan_loadN+0x1c/0x28<br /> memcmp+0x98/0xd0<br /> efivarfs_d_compare+0x68/0xd8<br /> __d_lookup_rcu_op_compare+0x178/0x218<br /> __d_lookup_rcu+0x1f8/0x228<br /> d_alloc_parallel+0x150/0x648<br /> lookup_open.isra.0+0x5f0/0x8d0<br /> open_last_lookups+0x264/0x828<br /> path_openat+0x130/0x3f8<br /> do_filp_open+0x114/0x248<br /> do_sys_openat2+0x340/0x3c0<br /> __arm64_sys_openat+0x120/0x1a0<br /> <br /> If dentry-&gt;d_name.len lookup<br /> simple_lookup<br /> d_add<br /> // invalid dentry is added to hash list<br /> <br /> lookup_open<br /> d_alloc_parallel<br /> __d_lookup_rcu<br /> __d_lookup_rcu_op_compare<br /> hlist_bl_for_each_entry_rcu<br /> // invalid dentry can be retrieved<br /> -&gt;d_compare<br /> efivarfs_d_compare<br /> // oob<br /> <br /> Fix it by checking &amp;#39;guid&amp;#39; before cmp.