CVE-2026-89604

In the Linux kernel, the following vulnerability has been resolved:

efivarfs: Rate limit statfs() handler

Ravi reports that statfs() may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls to the QueryVariableInfo() runtime service. These calls are disproportionately costly on x86 systems where the variable store is backed by SMM, as each SMM entry requires a rendez-vous of all the CPUs.

So rate limit the calls to QueryVariableInfo() at twice per second, and return the most recently obtained value for calls that are elided.