Bypassing Secure Boot Lockdown in GRUB Configuration

CVE-2026-97876

What is CVE-2026-97876?

A local attacker with access to GRUB's configuration can exploit a flaw that allows for the bypass of Secure Boot restrictions. This vulnerability occurs when GRUB fails to appropriately validate the MMIO base address that is provided with the serial command. As a result, the attacker can persuade GRUB to write to an inappropriate memory address rather than a designated UART device. This exploit can lead to the loading of unsigned GRUB modules, as it enables the attacker to manipulate the grub_file_verifiers list, effectively disabling the module verification process, while GRUB incorrectly indicates that lockdown measures are active.

References