Description
A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grub_strcpy() function. During this step, it fails to consider the environment variable length when allocating the internal buffer, resulting in an out-of-bounds write. If correctly exploited, this issue may result in remote code execution through the same network segment grub is searching for the boot information, which can be used to by-pass secure boot protections.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | grub2 | ≤ 2.12 | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | grub2 | 2.12-6 | — |
| Debian 13 | grub2 | 2.12-6 | — |
| Debian 12 | grub2 | 2.06-13+deb12u2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | grub2-signed +1 | No fix yet | — |
| Ubuntu 26.04 LTS | grub2-signed +1 | No fix yet | — |
| Ubuntu 25.10 | grub2-signed +1 | No fix yet | — |
| Ubuntu 24.04 LTS | grub2-signed +1 | No fix yet | — |
| Ubuntu 22.04 LTS | grub2-signed +1 | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | grub2-signed +1 | No fix yet | — |
| Ubuntu 18.04 LTS | grub2-signed +1 | No fix yet | — |
| Ubuntu 16.04 LTS | grub2-signed +1 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | grub2 +1 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | grub2 +15 | 1:2.06-94.el9_5 | RHSA-2025:2867 |
| RHEL 8 | grub2 +18 | 1:2.02-162.el8_10 | RHSA-2025:3367 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | grub2 +15 | 1:2.06-86.el9_4.2 | RHSA-2025:2675 |
| RHEL 9.2 EUS | grub2 +15 | 1:2.06-61.el9_2.10 | RHSA-2025:2869 |
| RHEL 9.0 E4S | grub2 +15 | 1:2.06-27.el9_0.22 | RHSA-2025:2799 |
| RHEL 8.8 EUS | grub2 +18 | 1:2.02-152.el8_8.2 | RHSA-2025:2521 |
| RHEL 8.6 TUS | grub2 +15 | 1:2.02-123.el8_6.18 | RHSA-2025:2653 |
| RHEL 8.6 E4S | grub2 +18 | 1:2.02-123.el8_6.18 | RHSA-2025:2653 |
| RHEL 8.6 AUS | grub2 +15 | 1:2.02-123.el8_6.18 | RHSA-2025:2653 |
| RHEL 8.4 TUS | grub2 +15 | 1:2.02-99.el8_4.12 | RHSA-2025:2655 |
| RHEL 8.4 E4S | grub2 +16 | 1:2.02-99.el8_4.12 | RHSA-2025:2655 |
| RHEL 8.4 AUS | grub2 +15 | 1:2.02-99.el8_4.12 | RHSA-2025:2655 |
| RHEL 8.2 AUS | grub2 +15 | 1:2.02-87.el8_2.13 | RHSA-2025:2784 |
| RHEL 7 ELS | grub2 +17 | 1:2.02-0.87.el7_9.15 | RHSA-2025:3396 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | grub2-pc +14 | 1:2.06-94.el9_5.alma.1 | ALSA-2025:2867 |
| AlmaLinux 8 | grub2-pc +17 | 1:2.02-162.el8_10.alma.1 | ALSA-2025:3367 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | grub2 | 1:2.06-94.el9_5 | RLSA-2025:2867 |
| Rocky Linux 8 | grub2 | 1:2.02-162.el8_10.rocky.0.1 | RLSA-2025:3367 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | grub2 | 2.12-150600.8.18.2 | SUSE-SU-2025:0586-1 |
| SLES 15 SP5 | grub2 | 2.06-150500.29.43.2 | SUSE-SU-2025:0587-1 |
| SLES 15 SP4 | grub2 | 2.06-150400.11.55.2 | SUSE-SU-2025:0588-1 |
| SLES 15 SP3 | grub2 | 2.04-150300.22.52.3 | SUSE-SU-2025:0607-1 |
| SLES 12 SP5 | grub2 | 2.02-181.2 | SUSE-SU-2025:0629-1 |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | grub2 | 2.06-150500.29.43.2 | SUSE-SU-2025:0587-1 |
| SLES for SAP 15 SP4 | grub2 | 2.06-150400.11.55.2 | SUSE-SU-2025:0588-1 |
| SLES for SAP 15 SP3 | grub2 | 2.04-150300.22.52.3 | SUSE-SU-2025:0607-1 |
| SLE Micro 6.1 | grub2 | 2.12-slfo.1.1_2.1 | SUSE-SU-2025:20863-1 |
| SLE Micro 6.0 | grub2 | 2.12~rc1-6.1 | SUSE-SU-2025:20511-1 |
| SLE Micro 5.5 | grub2 | 2.06-150500.29.43.2 | SUSE-SU-2025:0587-1 |
| SLE Micro 5.4 | grub2 | 2.06-150400.11.55.2 | SUSE-SU-2025:0588-1 |
| SLE Micro 5.3 | grub2 | 2.06-150400.11.55.2 | SUSE-SU-2025:0588-1 |
| SLE Micro 5.2 | grub2 | 2.04-150300.22.52.3 | SUSE-SU-2025:0607-1 |
| SLE Micro 5.1 | grub2 | 2.04-150300.3.11.1 | SUSE-SU-2025:01961-1 |
| SLE HPC 15 SP5 | grub2 | 2.06-150500.29.43.2 | SUSE-SU-2025:0587-1 |
| SLE HPC 15 SP4 | grub2 | 2.06-150400.11.55.2 | SUSE-SU-2025:0588-1 |
| SLE HPC 15 SP3 | grub2 | 2.04-150300.22.52.3 | SUSE-SU-2025:0607-1 |
| SUSE Manager Server Module 4.3 | grub2 | 2.06-150400.11.55.2 | SUSE-SU-2025:0588-1 |
| SUSE Manager Server 4.3 | grub2 | 2.06-150400.11.55.2 | SUSE-SU-2025:0588-1 |
| SUSE Manager Proxy Module 4.3 | grub2 | 2.06-150400.11.55.2 | SUSE-SU-2025:0588-1 |
| SUSE Manager Proxy 4.3 | grub2 | 2.06-150400.11.55.2 | SUSE-SU-2025:0588-1 |
| SUSE Enterprise Storage 7.1 | grub2 | 2.04-150300.22.52.3 | SUSE-SU-2025:0607-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | grub2 | 2.12-35.1 | openSUSE-SU-2025:14822-1 |
| openSUSE Leap 15.6 | grub2 | 2.12-150600.8.18.2 | SUSE-SU-2025:0586-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | grub2-pc +16 | 1:2.06-61.amzn2023.0.16 | ALAS2023-2025-937 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | grub2 | 2.06-24 | — |
| Azure Linux 2 (CBL-Mariner) | grub2 | 2.06-14 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | grub2-pc +12 | 1:2.06-94.0.1.el9_5 | ELSA-2025-2867 |
| Oracle Linux 8 | grub2-pc +15 | 1:2.02-164.0.2.el8_10 | ELSA-2025-3367 |
| Oracle Linux 7 | grub2 +12 | 1:2.02-0.87.0.27.el7_9.14 | ELSA-2025-3396 |
Advisories 29
- ALSA-2025:2867 Important: grub2 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:3367 Important: grub2 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:3396 Red Hat Security Advisory: grub2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:3367 Red Hat Security Advisory: grub2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:2867 Red Hat Security Advisory: grub2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:2869 Red Hat Security Advisory: grub2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:2799 Red Hat Security Advisory: grub2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:2784 Red Hat Security Advisory: grub2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:2675 Red Hat Security Advisory: grub2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:2655 Red Hat Security Advisory: grub2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:2653 Red Hat Security Advisory: grub2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:2521 Red Hat Security Advisory: grub2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- WID-SEC-2025-1559 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2025-0396 Grub: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2026
- RLSA-2025:3367 Important: grub2 security update Rocky Linux Security Advisories · May 21, 2026
- SUSE-SU-2025:20863-1 Security update for grub2 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20511-1 Security update for grub2 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:01961-1 Security update for grub2 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:0586-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0629-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0607-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0587-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2025:2867 Important: grub2 security update Rocky Linux Security Advisories · Jul 29, 2025
- openSUSE-SU-2025:14822-1 grub2-2.12-35.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2025:0588-1 Security update for grub2 SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2025-3367 Important: grub2 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 21, 2025
- ALAS2023-2025-937 Moderate: grub2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 14, 2025
- ELSA-2025-3396 Important: grub2 security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 11, 2025
- ELSA-2025-2867 Important: grub2 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Mar 17, 2025
References
- RHSA-2025:2521 vendor-advisory
- RHSA-2025:2653 vendor-advisory
- RHSA-2025:2655 vendor-advisory
- RHSA-2025:2675 vendor-advisory
- RHSA-2025:2784 vendor-advisory
- RHSA-2025:2799 vendor-advisory
- RHSA-2025:2867 vendor-advisory
- RHSA-2025:2869 vendor-advisory
- RHSA-2025:3297 vendor-advisory
- RHSA-2025:3301 vendor-advisory
- RHSA-2025:3367 vendor-advisory
- RHSA-2025:3396 vendor-advisory
- RHSA-2025:3573 vendor-advisory
- RHSA-2025:3577 vendor-advisory
- RHSA-2025:3780 vendor-advisory
- RHSA-2025:4422 vendor-advisory
- RHSA-2025:7702 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-0624 vdb-entry
- RHBZ#2346112 issue-tracking