LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21872: efi: Don't map the entire mokvar table to determine its size

In the Linux kernel, the following vulnerability has been resolved: efi: Don't map the entire mokvar table to determine its size Currently, when validating the mokvar table, we (re)map the entire table on each iteration of the loop, adding space as we discover new entries. If the table grows over a certain size, this fails due to limitations of early_memmap(), and we get a failure and traceback: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at mm/early_ioremap.c:139 __early_ioremap+0xef/0x220 ... Call Trace: <TASK> ? __early_ioremap+0xef/0x220 ? __warn.cold+0x93/0xfa ? __early_ioremap+0xef/0x220 ? report_bug+0xff/0x140 ? early_fixup_exception+0x5d/0xb0 ? early_idt_handler_common+0x2f/0x3a ? __early_ioremap+0xef/0x220 ? efi_mokvar_table_init+0xce/0x1d0 ? setup_arch+0x864/0xc10 ? start_kernel+0x6b/0xa10 ? x86_64_start_reservations+0x24/0x30 ? x86_64_start_kernel+0xed/0xf0 ? common_startup_64+0x13e/0x141 </TASK> ---[ end trace 0000000000000000 ]--- mokvar: Failed to map EFI MOKvar config table pa=0x7c4c3000, size=265187. Mapping the entire structure isn't actually necessary, as we don't ever need more than one entry header mapped at once. Changes efi_mokvar_table_init() to only map each entry header, not the entire table, when determining the table size. Since we're not mapping any data past the variable name, it also changes the code to enforce that each variable name is NUL terminated, rather than attempting to verify it in place.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can make early boot handling of EFI MOK variables fail when the MOK variable table is large. The public record describes a kernel warning and mapping failure during startup, not data theft or remote compromise.

Executive priority

Treat this as a kernel maintenance item with potential boot reliability impact. Prioritize environments where Secure Boot, MOK enrollment, or unattended boot availability matters, but do not treat it as confirmed actively exploited based on the supplied evidence.

Technical view

The kernel’s EFI MOKvar validation remapped the whole table while discovering entries. Large tables could exceed early_memmap limits and trigger an early_ioremap warning and MOKvar mapping failure. The fix maps only one entry header at a time and enforces NUL termination of variable names.

Likely exposure

Exposure is limited to systems running affected Linux kernels where EFI MOKvar table processing is relevant. The bundle lists Linux kernel versions and stable commit references, but exact downstream distro exposure depends on vendor backports and package status.

Exploitation context

The supplied sources do not show active exploitation, weaponized proof of concept, or CISA KEV listing. The described impact is an early boot mapping failure and traceback under large MOKvar table conditions.

Researcher notes

Key evidence is the kernel commit description: failure occurs because the code maps the entire MOKvar table while determining size. The patch changes efi_mokvar_table_init() behavior. Public metadata lacks CVSS, CWE, and detailed exploitability analysis.

Mitigation direction

  • Apply Linux kernel updates from your operating system vendor.
  • Track the referenced upstream stable kernel commits for fixed builds.
  • Review Debian LTS guidance where Debian LTS systems are in scope.
  • Avoid relying on upstream version numbers without checking distro backports.
  • Escalate boot-critical EFI/Secure Boot systems for earlier maintenance windows.

Validation and detection

  • Inventory Linux kernel versions across EFI-based systems.
  • Check vendor advisories for CVE-2025-21872 coverage.
  • Confirm installed kernels include the referenced stable fixes or vendor backports.
  • Review boot logs for MOKvar or early_ioremap warnings.
  • Validate updates first on representative Secure Boot hosts.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21872 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux58c909022a5a56cd1d9e89c8c5461fd1f6a27bb5, 58c909022a5a56cd1d9e89c8c5461fd1f6a27bb5, 58c909022a5a56cd1d9e89c8c5461fd1f6a27bb5, 58c909022a5a56cd1d9e89c8c5461fd1f6a27bb5, 58c909022a5a56cd1d9e89c8c5461fd1f6a27bb5unaffected
LinuxLinux5.10, 0, 5.10.235, 6.6.83, 6.12.18, 6.13.6, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.