GRUB2 (USB device initialization): Out-of-bounds write in grub_usb_device_initialize from a malicious USB descriptor

Impact

Out-of-bounds write in grub_usb_device_initialize from a malicious USB descriptor. In a datacenter this is not a 'someone walks up with a USB stick' story - the BMC presents virtual media as a USB device, so anyone with BMC credentials can trigger it entirely remotely.

Who can reach it

Physical USB, or - the one that matters - BMC virtual media, which turns this into a remote attack for anyone on the management VLAN with iDRAC/iLO/XCC credentials.

What to do

grub2 package update + reboot. Meaningful compensating control: disable virtual media on the BMC where you do not use it for provisioning, and keep the management network off any tenant-reachable path.

References

Related entries

• AMD Secure Processor PCI driver - input validation: Improper input validation in the ASP PCI driver lets a localCVE-2025-0045 · AMD Secure Processor PCI driver - input validationMedium
• AMD SEV firmware - RMP write during SNP initialization: A privileged attacker can write to the reverse map page duringCVE-2025-29939 · AMD SEV firmware - RMP write during SNP initializationMedium
• AMD Secure Processor PCI driver - use-after-free: A use-after-free reachable through the ASP PCI driverCVE-2025-48521 · AMD Secure Processor PCI driver - use-after-freeMedium
• IBM Power Systems FSP: authenticated admin can force a persistent degraded operating modeCVE-2026-16938 · IBM Power Systems Firmware (FSP privileged system configuration controls)Medium
• Arista EOS: crafted password creates orphan sessions until logins are exhaustedCVE-2026-19641 · Arista EOS password authentication (session handling)Medium
• Arista EOS: gNSI Authz Rotate can activate the in-flight authorization policyCVE-2026-73445 · Arista EOS gNSI Authz Rotate RPCMedium