# CVE-2025-54770: GNU GRUB2 Use-after-Free in net_set_vlan command

Source: https://junglewise.ai/threats/cve-2025-54770-gnu-grub2-use-after-free-in-net-set-vlan-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-18. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2025-54770 · Severity: medium · CVSS 4.9 · Published 2025-11-18

A vulnerability has been found in the GRUB2 bootloader, the software responsible for starting up many Linux-based computers. A flaw in its networking component could allow a user with local access to crash the system during the boot process. This results in a denial-of-service, preventing the computer from starting or operating reliably until it is manually recovered.

Technologies: [Gnu Grub2](https://junglewise.ai/threats/technologies/grub2). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2025-54770 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-54770 being exploited in the wild.

**How severe is CVE-2025-54770?** Medium severity, with a CVSS score of 4.9, published 18 November 2025.

**Which products and versions are affected?** Gnu Grub2 All versions prior to November 2025 security patches.

**Is there a fix for CVE-2025-54770?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-54770 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2025-54770?** Check whether you run Gnu Grub2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Use-after-Free (UAF) vulnerability exists in the GRUB2 bootloader's network module due to an 'Expired Pointer Dereference' (CWE-825). The 'net_set_vlan' command is registered when the network module is loaded but is not properly unregistered when the module is unloaded from memory. An attacker with the ability to execute GRUB commands locally can invoke 'net_set_vlan' after the module has been unloaded, forcing the system to access invalid memory locations. This leads to system instability or a complete crash. Patches have been released upstream in the GRUB2 repository to ensure the command is correctly unregistered during module finalization.

## Affected products

- GNU GRUB2 All versions prior to November 2025 security patches

## Timeline

- 2025-11-10: other: Vulnerability reported to Red Hat Bugzilla
- 2025-11-18: disclosed: Public disclosure and security patch release
- 2025-11-18: advisory: NVD and Red Hat advisories published

## References

- [https://access.redhat.com/security/cve/CVE-2025-54770](https://access.redhat.com/security/cve/CVE-2025-54770)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2413813](https://bugzilla.redhat.com/show_bug.cgi?id=2413813)
- [https://lists.gnu.org/archive/html/grub-devel/2025-11/msg00155.html](https://lists.gnu.org/archive/html/grub-devel/2025-11/msg00155.html)
- [http://www.openwall.com/lists/oss-security/2025/11/18/4](http://www.openwall.com/lists/oss-security/2025/11/18/4)

## Related threats

- [GNU GRUB2 use after free in normal_exit command](https://junglewise.ai/threats/cve-2025-61664-gnu-grub2-use-after-free-in-normal-exit-command)
- [GNU GRUB use-after-free in gettext module](https://junglewise.ai/threats/cve-2025-61662-gnu-grub-use-after-free-in-gettext-module)
- [GNU GRUB use-after-free in grub_file_close](https://junglewise.ai/threats/cve-2025-54771-gnu-grub-use-after-free-in-grub-file-close)