Description (CNA)
A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| GNU / grub2 | affected 0 through 2.14 |
| Red Hat / Red Hat Enterprise Linux 10 | affected |
| Red Hat / Red Hat Enterprise Linux 7 | affected |
| Red Hat / Red Hat Enterprise Linux 8 | affected |
| Red Hat / Red Hat Enterprise Linux 9 | affected |
| Red Hat / Red Hat OpenShift Container Platform 4 | affected |
| Red Hat / Red Hat OpenShift Container Platform 4 | affected |
CWE
CWE-825
References
- https://access.redhat.com/security/cve/CVE-2025-54771
- https://bugzilla.redhat.com/show_bug.cgi?id=2413823
- https://lists.gnu.org/archive/html/grub-devel/2025-11/msg00155.html
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.