Executive brief
A vulnerability has been found in the GNU GRUB bootloader, the software responsible for starting a computer's operating system. The flaw occurs when the system closes files, potentially allowing the software to crash or behave unpredictably. This could lead to a denial of service or, in some cases, allow an attacker to compromise the integrity of the boot process.
Technical details
A use-after-free vulnerability exists in the grub_file_close() function of GNU GRUB. The root cause is a failure to properly manage filesystem reference counts; specifically, the code may attempt to access the filesystem structure after its associated module has been dereferenced via grub_dl_unref(). An attacker with local access could exploit this flaw to trigger a crash (Denial of Service) or potentially achieve more complex memory corruption. The vulnerability is addressed by reordering the closing sequence to ensure grub_dl_unref() is called only after the filesystem-specific close operation is complete. Patches have been released by the GRUB maintainers and are being integrated by Linux distributions.
Affected products
- GNU GRUB2
Timeline
- 2025-11-10: other: Reported to Red Hat Bugzilla
- 2025-11-18: disclosed: Public disclosure via oss-security and GNU mailing lists
- 2025-11-18: patched: Security patches released upstream