In the Linux kernel, the following vulnerability has been resolved:
efi: Don't map the entire mokvar table to determine its size
Currently, when validating the mokvar table, we (re)map the entire table on each iteration of the loop, adding space as we discover new entries. If the table grows over a certain size, this fails due to limitations of early_memmap(), and we get a failure and traceback:
------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at mm/earlyioremap.c:139 _earlyioremap+0xef/0x220 ... Call Trace: <TASK> ? _earlyioremap+0xef/0x220 ? _warn.cold+0x93/0xfa ? _earlyioremap+0xef/0x220 ? reportbug+0xff/0x140 ? earlyfixupexception+0x5d/0xb0 ? earlyidthandlercommon+0x2f/0x3a ? _earlyioremap+0xef/0x220 ? efimokvartableinit+0xce/0x1d0 ? setuparch+0x864/0xc10 ? startkernel+0x6b/0xa10 ? x8664startreservations+0x24/0x30 ? x8664startkernel+0xed/0xf0 ? commonstartup_64+0x13e/0x141 </TASK> ---[ end trace 0000000000000000 ]--- mokvar: Failed to map EFI MOKvar config table pa=0x7c4c3000, size=265187.
Mapping the entire structure isn't actually necessary, as we don't ever need more than one entry header mapped at once.
Changes efimokvartable_init() to only map each entry header, not the entire table, when determining the table size. Since we're not mapping any data past the variable name, it also changes the code to enforce that each variable name is NUL terminated, rather than attempting to verify it in place.
[
{
"deprecated": false,
"target": {
"file": "drivers/firmware/efi/mokvar-table.c",
"function": "efi_mokvar_table_init"
},
"digest": {
"length": 1371.0,
"function_hash": "72442583801746069595329350683765830164"
},
"id": "CVE-2025-21872-309b512d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65f4aebb8127708ba668dd938e83b8558abfc5cd",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/firmware/efi/mokvar-table.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"82201347896484127826980989153866188990",
"198808098248949080312419350738641050698",
"265515862675366651345737842282565725647",
"44240011421028361519489300590822038324",
"274242087889866537078827564049759891458",
"263984794028857227327852410373222034570",
"263475828591892860820618460363704653659",
"168048478740675545629383879306397347726",
"47329866581098665030089114632937726321",
"45143791570722645394504178299246424086",
"300266600799299590701057752363396386984",
"111825175544446516094370144648253799903",
"338387303001039286803025762255896574360",
"110396978127658418000705512164996726938",
"115755627711275284308406247424109982668",
"191581835183038815715826440397793364471",
"291683605084114510573119727228625658652",
"66570807842434996894217406289622498106",
"169932478188265860892829055764604000948",
"282761200427206380614254410067851471960",
"115300494587339156688984985878547610833",
"226274892456006990524396402092956193211",
"73153252702932899793114831557071846885",
"325499299318410218983359288499130795457",
"324871773901567500392741943427501666820",
"242726603685832597191444443692281690516",
"78507387658813831067984454218791260853",
"157457556479480863808766422615520172208",
"264255250810063752567976537556708519957",
"205151312612887917490542064202471564601",
"81899623019831811990797356775072670638",
"265393989904438334412850943715290657862",
"296304846418555443143340664393444764050",
"135932183760494679042139940115759572772",
"281112936226652325285253392795518745564",
"195791556524653286402775815213232476801",
"156435883375403709529774259539835820153",
"143136344104251311409911352599328679147"
]
},
"id": "CVE-2025-21872-373ea4f9",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65f4aebb8127708ba668dd938e83b8558abfc5cd",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/firmware/efi/mokvar-table.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"82201347896484127826980989153866188990",
"198808098248949080312419350738641050698",
"265515862675366651345737842282565725647",
"44240011421028361519489300590822038324",
"274242087889866537078827564049759891458",
"263984794028857227327852410373222034570",
"263475828591892860820618460363704653659",
"168048478740675545629383879306397347726",
"47329866581098665030089114632937726321",
"45143791570722645394504178299246424086",
"300266600799299590701057752363396386984",
"111825175544446516094370144648253799903",
"338387303001039286803025762255896574360",
"110396978127658418000705512164996726938",
"115755627711275284308406247424109982668",
"191581835183038815715826440397793364471",
"291683605084114510573119727228625658652",
"66570807842434996894217406289622498106",
"169932478188265860892829055764604000948",
"282761200427206380614254410067851471960",
"115300494587339156688984985878547610833",
"226274892456006990524396402092956193211",
"73153252702932899793114831557071846885",
"325499299318410218983359288499130795457",
"324871773901567500392741943427501666820",
"242726603685832597191444443692281690516",
"78507387658813831067984454218791260853",
"157457556479480863808766422615520172208",
"264255250810063752567976537556708519957",
"205151312612887917490542064202471564601",
"81899623019831811990797356775072670638",
"265393989904438334412850943715290657862",
"296304846418555443143340664393444764050",
"135932183760494679042139940115759572772",
"281112936226652325285253392795518745564",
"195791556524653286402775815213232476801",
"156435883375403709529774259539835820153",
"143136344104251311409911352599328679147"
]
},
"id": "CVE-2025-21872-4b58951b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea3f0b362dfe4ef885ef812bfaf4088176422c91",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/firmware/efi/mokvar-table.c",
"function": "efi_mokvar_table_init"
},
"digest": {
"length": 1371.0,
"function_hash": "72442583801746069595329350683765830164"
},
"id": "CVE-2025-21872-5d7aa973",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea3f0b362dfe4ef885ef812bfaf4088176422c91",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/firmware/efi/mokvar-table.c",
"function": "efi_mokvar_table_init"
},
"digest": {
"length": 1371.0,
"function_hash": "72442583801746069595329350683765830164"
},
"id": "CVE-2025-21872-6dc41e6f",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b90e7ace79774a3540ce569e000388f8d22c9e0",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/firmware/efi/mokvar-table.c",
"function": "efi_mokvar_table_init"
},
"digest": {
"length": 1371.0,
"function_hash": "72442583801746069595329350683765830164"
},
"id": "CVE-2025-21872-77fe9e9d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@97bd560b6cc4c26386a53b4881bf03e96f9ba03a",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/firmware/efi/mokvar-table.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"82201347896484127826980989153866188990",
"198808098248949080312419350738641050698",
"265515862675366651345737842282565725647",
"44240011421028361519489300590822038324",
"274242087889866537078827564049759891458",
"263984794028857227327852410373222034570",
"263475828591892860820618460363704653659",
"168048478740675545629383879306397347726",
"47329866581098665030089114632937726321",
"45143791570722645394504178299246424086",
"300266600799299590701057752363396386984",
"111825175544446516094370144648253799903",
"338387303001039286803025762255896574360",
"110396978127658418000705512164996726938",
"115755627711275284308406247424109982668",
"191581835183038815715826440397793364471",
"291683605084114510573119727228625658652",
"66570807842434996894217406289622498106",
"169932478188265860892829055764604000948",
"282761200427206380614254410067851471960",
"115300494587339156688984985878547610833",
"226274892456006990524396402092956193211",
"73153252702932899793114831557071846885",
"325499299318410218983359288499130795457",
"324871773901567500392741943427501666820",
"242726603685832597191444443692281690516",
"78507387658813831067984454218791260853",
"157457556479480863808766422615520172208",
"264255250810063752567976537556708519957",
"205151312612887917490542064202471564601",
"81899623019831811990797356775072670638",
"265393989904438334412850943715290657862",
"296304846418555443143340664393444764050",
"135932183760494679042139940115759572772",
"281112936226652325285253392795518745564",
"195791556524653286402775815213232476801",
"156435883375403709529774259539835820153",
"143136344104251311409911352599328679147"
]
},
"id": "CVE-2025-21872-99c1a25e",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@97bd560b6cc4c26386a53b4881bf03e96f9ba03a",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/firmware/efi/mokvar-table.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"82201347896484127826980989153866188990",
"198808098248949080312419350738641050698",
"265515862675366651345737842282565725647",
"44240011421028361519489300590822038324",
"263475828591892860820618460363704653659",
"168048478740675545629383879306397347726",
"47329866581098665030089114632937726321",
"45143791570722645394504178299246424086",
"300266600799299590701057752363396386984",
"111825175544446516094370144648253799903",
"338387303001039286803025762255896574360",
"110396978127658418000705512164996726938",
"115755627711275284308406247424109982668",
"191581835183038815715826440397793364471",
"291683605084114510573119727228625658652",
"66570807842434996894217406289622498106",
"169932478188265860892829055764604000948",
"282761200427206380614254410067851471960",
"115300494587339156688984985878547610833",
"226274892456006990524396402092956193211",
"73153252702932899793114831557071846885",
"325499299318410218983359288499130795457",
"324871773901567500392741943427501666820",
"242726603685832597191444443692281690516",
"78507387658813831067984454218791260853",
"157457556479480863808766422615520172208",
"264255250810063752567976537556708519957",
"205151312612887917490542064202471564601",
"81899623019831811990797356775072670638",
"265393989904438334412850943715290657862",
"296304846418555443143340664393444764050",
"135932183760494679042139940115759572772",
"281112936226652325285253392795518745564",
"195791556524653286402775815213232476801",
"156435883375403709529774259539835820153",
"143136344104251311409911352599328679147"
]
},
"id": "CVE-2025-21872-9e6fc2c4",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b90e7ace79774a3540ce569e000388f8d22c9e0",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/firmware/efi/mokvar-table.c",
"function": "efi_mokvar_table_init"
},
"digest": {
"length": 1371.0,
"function_hash": "72442583801746069595329350683765830164"
},
"id": "CVE-2025-21872-c2dc3693",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46c0454ffb78ce9d3355a3cccac86383ea8ddd55",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/firmware/efi/mokvar-table.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"82201347896484127826980989153866188990",
"198808098248949080312419350738641050698",
"265515862675366651345737842282565725647",
"44240011421028361519489300590822038324",
"263475828591892860820618460363704653659",
"168048478740675545629383879306397347726",
"47329866581098665030089114632937726321",
"45143791570722645394504178299246424086",
"300266600799299590701057752363396386984",
"111825175544446516094370144648253799903",
"338387303001039286803025762255896574360",
"110396978127658418000705512164996726938",
"115755627711275284308406247424109982668",
"191581835183038815715826440397793364471",
"291683605084114510573119727228625658652",
"66570807842434996894217406289622498106",
"169932478188265860892829055764604000948",
"282761200427206380614254410067851471960",
"115300494587339156688984985878547610833",
"226274892456006990524396402092956193211",
"73153252702932899793114831557071846885",
"325499299318410218983359288499130795457",
"324871773901567500392741943427501666820",
"242726603685832597191444443692281690516",
"78507387658813831067984454218791260853",
"157457556479480863808766422615520172208",
"264255250810063752567976537556708519957",
"205151312612887917490542064202471564601",
"81899623019831811990797356775072670638",
"265393989904438334412850943715290657862",
"296304846418555443143340664393444764050",
"135932183760494679042139940115759572772",
"281112936226652325285253392795518745564",
"195791556524653286402775815213232476801",
"156435883375403709529774259539835820153",
"143136344104251311409911352599328679147"
]
},
"id": "CVE-2025-21872-ede80a3a",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46c0454ffb78ce9d3355a3cccac86383ea8ddd55",
"signature_version": "v1"
}
]