Commit bd9b3c50f4 for qemu.org

commit bd9b3c50f458ce24fee084916cf0eba58bd9a33b
Author: Gerd Hoffmann <kraxel@redhat.com>
Date:   Mon Jul 20 16:32:42 2026 +0200

    hw/uefi: make SetupMode read-only

    This is read-only variable which informs the OS about the
    secure boot state.  Reject any attempts to write to it.

    Fixes: CVE-2026-16288
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4039
    Acked-by: Luigi Leonardi <leonardi@redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    Message-ID: <20260720143244.821889-7-kraxel@redhat.com>

diff --git a/hw/uefi/var-service-auth.c b/hw/uefi/var-service-auth.c
index f3dc9c6ca6..899444af12 100644
--- a/hw/uefi/var-service-auth.c
+++ b/hw/uefi/var-service-auth.c
@@ -298,6 +298,13 @@ efi_status uefi_vars_check_secure_boot(uefi_vars_state *uv, uefi_variable *var)
         return EFI_WRITE_PROTECTED;
     }

+    /* reject SetupMode updates */
+    if (qemu_uuid_is_equal(&var->guid, &EfiGlobalVariable) &&
+        uefi_str_equal(var->name, var->name_size,
+                       name_setup_mode, sizeof(name_setup_mode))) {
+        return EFI_WRITE_PROTECTED;
+    }
+
     return EFI_SUCCESS;
 }