Moderate Vulnerability in grub2: Use-After-Free Risk Due to Missing Unregister Call
Summary
RLSA-2026:4649: Moderate: grub2 security update. Affects grub2 versions < 1:2.12-29.el10_1.2.rocky.0.1. Fixed in 1:2.12-29.el10_1.2.rocky.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The grub2 package is the second version of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader that supports various kernel formats, file systems, computer architectures, and hardware devices. It plays a crucial role in the boot process of operating systems, allowing users to select which OS to boot and providing options for kernel parameters.
Vulnerability Detail
The vulnerability identified as CVE-2025-61662 arises from a missing unregister call for the gettext command within the grub2 package. This oversight can lead to a use-after-free condition, where the program attempts to access memory that has already been freed. Such vulnerabilities can be exploited by attackers to execute arbitrary code, potentially compromising the system's integrity and confidentiality.
How To Fix
Minimum fixed version
1:2.12-29.el10_1.2.rocky.0.1
This is the first release that contains the fix.
sudo dnf update grub2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available updates as soon as possible.
Conclusion
The grub2 package has a moderate vulnerability (CVE-2025-61662) due to a missing unregister call, which can lead to serious security risks. It is crucial to update the package to the latest version to mitigate these risks. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for grub2 →
FAQ
CVE-2025-61662 is a security vulnerability in the grub2 package that can lead to a use-after-free condition due to a missing unregister call for the gettext command.
If exploited, this vulnerability could allow attackers to execute arbitrary code, potentially compromising the system's security and stability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 7.8, indicating a moderate severity level.
You can update the grub2 package by running the command 'sudo yum update grub2' in your terminal to ensure you have the latest security fixes.
Related vulnerabilities
Recent vulnerabilities recorded for grub2.
