GRUB2 (rmmod command): Use-after-free in the rmmod command

Impact

Use-after-free in the rmmod command. Unloading a module whose dependencies are still live leaves dangling pointers GRUB will later call through, which is a clean primitive for arbitrary pre-boot execution and another Secure Boot bypass.

Who can reach it

Local, via GRUB command line or a controlled grub.cfg. On a bare-metal fleet, any tenant who had console or root on the node.

What to do

grub2 package update + reboot per node. If you leave the GRUB command line unlocked on your image, set a GRUB password as a stopgap - it does not fix the bug but it removes the easiest path to it.

References