Executive brief
A vulnerability has been found in the GRUB2 bootloader, the software responsible for starting a computer's operating system. A flaw in how the bootloader manages its internal commands could allow an attacker with local access to crash the system or potentially interfere with data integrity during the boot process. This issue primarily affects the reliability and security of the system's startup sequence.
Technical details
A Use-After-Free (UAF) vulnerability exists in the GRUB2 bootloader within the 'normal' module. The root cause is a failure to unregister the 'normal_exit' command during module unloading. An attacker with the ability to execute GRUB commands (typically via local access or a compromised boot environment) can invoke the command after its parent module has been removed from memory. This leads to an expired pointer dereference (CWE-825), potentially resulting in a system crash, arbitrary code execution, or bypass of boot-time security restrictions. Patches have been released upstream in the GRUB2 git repository, and full mitigation in Secure Boot environments may require updated shim/SBAT revocations.
Affected products
- GNU GRUB2 All versions prior to November 2025 security patches
Timeline
- 2025-11-12: other: Reported to Red Hat Bugzilla
- 2025-11-18: disclosed: Public disclosure and upstream patches released
- 2025-11-18: patched: Upstream patches committed to GRUB2 repository