CVE-2026-6862 Efivar: efivar: denial of service due to stack overflow in device path node parsing
A local attacker can cause a denial of service via stack overflow in the efivar library's device path parser due to missing length validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-6862?
CVE-2026-6862 is a medium-severity denial of service vulnerability in Red Hat Enterprise Linux 10, published on 22 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4 bytes, which is the minimum size for an EFI (Extensible Firmware Interface) device path node header. A local user could exploit this vulnerability by providing a specially crafted device path node. This can lead to infinite recursion, causing stack exhaustion and a process crash, resulting in a denial of service (DoS).
Weakness: CWE-674
Which versions are affected by CVE-2026-6862?
It affects 1 product.
Linux distribution packages (3)
efivar Red Hat:hummingbird:1 | All versions | 0:39-13.1.hum1 |
efivar-devel Red Hat:hummingbird:1 | All versions | 0:39-13.1.hum1 |
efivar-libs Red Hat:hummingbird:1 | All versions | 0:39-13.1.hum1 |
Products include Ubuntu Libefiboot.
How do I fix CVE-2026-6862?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-6862 being exploited?
There is no known exploitation of CVE-2026-6862 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-6862, GHSA-364h-vxjm-52rp, OESA-2026-4450, RHSA-2026:69321, UBUNTU-CVE-2026-6862.