Moderate Security Vulnerability in grub2: Use-After-Free Risk
Summary
RLSA-2026:4760: Moderate: grub2 security update. Affects grub2 versions < 1:2.06-114.el9_7.1.rocky.0.1. Fixed in 1:2.06-114.el9_7.1.rocky.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The grub2 package is the second version of the Grand Unified Boot Loader (GRUB), which is a highly configurable and customizable boot loader. It supports various kernel formats, file systems, computer architectures, and hardware devices, making it essential for system boot processes. However, a recent security issue has been identified that may compromise its stability and security.
Vulnerability Detail
The vulnerability arises from a missing unregister call for the gettext command within the grub2 package, which can lead to a use-after-free condition. This flaw could potentially allow an attacker to exploit the system, leading to unauthorized access or manipulation of system resources. The vulnerability is cataloged under CVE-2025-61662 and has a CVSS score of 7.8, indicating a moderate level of severity.
How To Fix
Minimum fixed version
1:2.06-114.el9_7.1.rocky.0.1
This is the first release that contains the fix.
sudo dnf update grub2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the available security update as soon as possible.
Conclusion
In summary, the grub2 package has a moderate security vulnerability that could lead to serious implications if exploited. It is crucial to update the package to the latest version to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for grub2 →
FAQ
The vulnerability is a use-after-free issue caused by a missing unregister call for the gettext command.
Exploitation of this vulnerability could lead to unauthorized access or manipulation of system resources.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected.
The CVSS score for this vulnerability is 7.8, indicating a moderate level of severity.
The best protection is to update the grub2 package to the latest patched version using 'sudo yum update grub2'.
Related vulnerabilities
Recent vulnerabilities recorded for grub2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
