# CVE-2026-97876: GRUB serial command MMIO lockdown bypass

Source: https://junglewise.ai/threats/cve-2026-97876-a-local-attacker-with-control-over-grub-s-configuration-can  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-97876 · Severity: medium · CVSS 6.4 · Published 2026-10-02

GRUB, the bootloader used on millions of systems, has a flaw in how it validates memory addresses passed to the serial command when Secure Boot lockdown is active. An attacker with control over the system's boot configuration can exploit this to load unsigned code modules while GRUB falsely reports that security is enabled, potentially compromising the entire system before the operating system loads.

Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-97876 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97876 being exploited in the wild.

**How severe is CVE-2026-97876?** Medium severity, with a CVSS score of 6.4, published 2 October 2026.

**Which products and versions are affected?** Gnu GRUB 2.14 and earlier versions with ns8250 MMIO serial support.

**Is there a fix for CVE-2026-97876?** Yes: fixed in GRUB commit 26beaa3b (term/serial: Reject caller-supplied port addresses under lockdown). Until then: Restrict control over GRUB boot configuration using password protection or ensure only authenticated boot paths are available. On systems using Secure Boot, keep GRUB and shim/SBAT signatures up-to-date.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-09-13",
    "note": "Vulnerability disclosed on oss-security mailing list"
  },
  {
    "kind": "patched",
    "at": "2026-09-15",
    "note": "Fix committed upstream to reject caller-supplied addresses under lockdown"
  },
  {
    "kind": "advisory",
    "at": "2026-10-02",
    "note": "CVE-2026-97876 published"
  }
] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97876 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-97876?** Check whether you run Gnu GRUB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in GRUB commit 26beaa3b (term/serial: Reject caller-supplied port addresses under lockdown)

Restrict control over GRUB boot configuration using password protection or ensure only authenticated boot paths are available. On systems using Secure Boot, keep GRUB and shim/SBAT signatures up-to-date.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-09-13",
    "note": "Vulnerability disclosed on oss-security mailing list"
  },
  {
    "kind": "patched",
    "at": "2026-09-15",
    "note": "Fix committed upstream to reject caller-supplied addresses under lockdown"
  },
  {
    "kind": "advisory",
    "at": "2026-10-02",
    "note": "CVE-2026-97876 published"
  }
]

## Technical details

The vulnerability exists in GRUB's serial command under lockdown mode, which accepts a caller-supplied memory-mapped I/O (MMIO) base address without validating that it corresponds to a real UART device. An attacker can point the address at GRUB's grub_file_verifiers list in memory and trigger serial initialization, which writes fixed UART initialization values that clear the verifier list. This allows subsequent insmod commands to load unsigned modules without verification, while lockdown status remains reported as enabled. Exploitation requires control of GRUB's configuration or boot path and knowledge of the loaded image placement.

## Affected products

- GNU GRUB 2.14 and earlier versions with ns8250 MMIO serial support

## References

- [https://gitlab.freedesktop.org/gnu-grub/grub/-/commit/26beaa3b2720fefdc4d04c1ae209b776fe6848d6](https://gitlab.freedesktop.org/gnu-grub/grub/-/commit/26beaa3b2720fefdc4d04c1ae209b776fe6848d6)
- [https://www.openwall.com/lists/oss-security/2026/09/13/5](https://www.openwall.com/lists/oss-security/2026/09/13/5)