Executive brief
A vulnerability has been found in the GRUB2 bootloader, the software responsible for starting up many Linux-based computers. A flaw in its networking component could allow a user with local access to crash the system during the boot process. This results in a denial-of-service, preventing the computer from starting or operating reliably until it is manually recovered.
Technical details
A Use-after-Free (UAF) vulnerability exists in the GRUB2 bootloader's network module due to an 'Expired Pointer Dereference' (CWE-825). The 'net_set_vlan' command is registered when the network module is loaded but is not properly unregistered when the module is unloaded from memory. An attacker with the ability to execute GRUB commands locally can invoke 'net_set_vlan' after the module has been unloaded, forcing the system to access invalid memory locations. This leads to system instability or a complete crash. Patches have been released upstream in the GRUB2 repository to ensure the command is correctly unregistered during module finalization.
Affected products
- GNU GRUB2 All versions prior to November 2025 security patches
Timeline
- 2025-11-10: other: Vulnerability reported to Red Hat Bugzilla
- 2025-11-18: disclosed: Public disclosure and security patch release
- 2025-11-18: advisory: NVD and Red Hat advisories published