CVE-2025-21872 is a vulnerability identified in the Linux kernel related to the handling of the EFI (Extensible Firmware Interface) MOK (Machine Owner Key) variable table during early boot. The issue arises from the kernel's approach to mapping the entire MOK variable table repeatedly to determine its size. Specifically, the kernel remaps the entire mokvar table on each iteration while validating it, dynamically adding space as new entries are discovered. This approach leads to failures when the table grows beyond a certain size due to limitations in the early_memmap() function, which is responsible for memory mapping during early boot stages. The failure manifests as a kernel warning and traceback, indicating an inability to map the EFI MOKvar configuration table at a given physical address and size. This can cause boot failures or kernel panics during system startup. The root cause is that mapping the entire table is unnecessary since only one entry header needs to be mapped at a time to determine the table size. The fix implemented changes the efi_mokvar_table_init() function to map only each entry header individually rather than the entire table. Additionally, the code now enforces that each variable name within the table is NUL-terminated, improving validation and preventing attempts to verify variable names in place, which could lead to memory access issues. This vulnerability affects Linux kernel versions identified by the commit hash 58c909022a5a56cd1d9e89c8c5461fd1f6a27bb5 and likely other versions with similar EFI MOKvar handling logic. The vulnerability is not known to be exploited in the wild as of the published date (March 27, 2025). The issue occurs during the early boot process, which means exploitation would require control over EFI variables or the ability to influence the MOK variable table, typically a privileged or physical access scenario. Overall, this vulnerability is a memory mapping and validation flaw in the EFI MOK variable handling during Linux kernel initialization, which can cause boot failures or kernel warnings, potentially impacting system availability.

For European organizations, the impact of CVE-2025-21872 primarily concerns system availability and reliability, especially for servers and critical infrastructure running Linux kernels with EFI Secure Boot enabled and utilizing MOK variables. Systems affected may experience boot failures or kernel panics if the MOK variable table grows large enough to trigger the mapping failure. This can lead to downtime, disruption of services, and increased operational costs due to recovery efforts. Given that EFI Secure Boot and MOK are commonly used in enterprise Linux deployments to ensure boot integrity and trusted firmware, organizations relying on these security features may face challenges maintaining secure and stable boot processes until patches are applied. Although the vulnerability does not directly expose confidentiality or integrity risks, the denial of service caused by boot failures can indirectly affect business continuity. Moreover, organizations with automated or large-scale deployments might encounter this issue if MOK variable tables accumulate entries over time, especially in environments with frequent key enrollments or updates. The lack of known exploits reduces immediate risk, but the potential for accidental or maliciously induced boot failures remains a concern. In summary, the main impact is on system availability and operational stability, with potential cascading effects on business operations relying on affected Linux systems.

1. Apply the official Linux kernel patches that address CVE-2025-21872 as soon as they become available from trusted sources or Linux distributions. This patch modifies the EFI MOKvar table handling to prevent the mapping failure. 2. Monitor EFI MOK variable table sizes and manage the enrollment of MOK keys carefully to avoid excessive growth of the table. Remove obsolete or unnecessary keys to keep the table size manageable. 3. For environments using automated provisioning or configuration management, implement checks to detect abnormal increases in MOK variable entries and alert administrators. 4. Test kernel updates in staging environments to ensure compatibility and stability before deploying to production, especially for systems with Secure Boot enabled. 5. Maintain robust backup and recovery procedures to quickly restore systems in case of boot failures caused by this vulnerability. 6. Limit physical and administrative access to systems to prevent unauthorized modification of EFI variables, reducing the risk of malicious exploitation. 7. Stay informed through Linux kernel mailing lists and security advisories to track updates and related vulnerabilities in EFI and Secure Boot components.