The triggers On x86 systems backed by SMM, these calls require a rendezvous of all CPUs, which can overload the processor and degrade system performance. The vulnerability is a resource exhaustion flaw (CWE‑770), allowing a local attacker to induce a denial‑of‑service scenario by flooding the kernel with statfs() requests.

All Linux kernel releases prior to the. The vulnerability does not target a specific kernel version list, so any system that mounts efivarfs without the patch is at risk.

The CVSS score of 4.7 indicates a low‑to‑medium impact,, meaning the exploitation probability is low, as indicated by the EPSS score of < 1%. The attack vector is local, requiring only unprivileged access to an efivarfs mount point. If an attacker’s user can perform statfs() on that mount, the kernel will waste CPU cycles handling each request, potentially causing a slowdown or outage. Because the fix limits the calls to twice per second and reuses recent results, the post‑patch risk is significantly mitigated.