This is read-only variable which informs the OS about the secure boot state. Reject any attempts to write to it.
Fixes: CVE-2026-16288 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4039 Signed-off-by: Gerd Hoffmann <[email protected]> --- hw/uefi/var-service-auth.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hw/uefi/var-service-auth.c b/hw/uefi/var-service-auth.c index f3dc9c6ca608..899444af12df 100644 --- a/hw/uefi/var-service-auth.c +++ b/hw/uefi/var-service-auth.c @@ -298,6 +298,13 @@ efi_status uefi_vars_check_secure_boot(uefi_vars_state *uv, uefi_variable *var) return EFI_WRITE_PROTECTED; } + /* reject SetupMode updates */ + if (qemu_uuid_is_equal(&var->guid, &EfiGlobalVariable) && + uefi_str_equal(var->name, var->name_size, + name_setup_mode, sizeof(name_setup_mode))) { + return EFI_WRITE_PROTECTED; + } + return EFI_SUCCESS; } -- 2.55.0
