Use-after-Free Vulnerability in GRUB2 Bootloader's Network Module
CVE-2025-54770

4.9MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Vendor
CVE Published:
18 November 2025

What is CVE-2025-54770?

A vulnerability exists in the GRUB2 bootloader's network module that allows for a Denial of Service scenario. This issue arises when the net_set_vlan command is not properly unregistered upon the network module's removal from memory. An attacker can exploit this error to access invalid memory locations, resulting in severe system instability. The successful exploitation of this vulnerability can cause the system to crash, significantly affecting system availability.

References

https://access.redhat.com/security/cve/CVE-2025-54770
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2413813
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-54770 : Use-after-Free Vulnerability in GRUB2 Bootloader's Network Module