CVE-2026-89604

In the Linux kernel, the following vulnerability has been resolved:

efivarfs: Rate limit statfs() handler

Ravi reports that statfs() may be called by unprivileged users on the

efivarfs mount point, which may result in a flood of calls to the

QueryVariableInfo() runtime service. These calls are disproportionately

costly on x86 systems where the variable store is backed by SMM, as each

SMM entry requires a rendez-vous of all the CPUs.

So rate limit the calls to QueryVariableInfo() at twice per second, and

return the most recently obtained value for calls that are elided.