GRUB2 (commands/extcmd): A failed allocation goes unchecked, so GRUB proceeds on a NULL pointer and its state

Impact

A failed allocation goes unchecked, so GRUB proceeds on a NULL pointer and its state becomes attacker-influenced. Practical outcome is the same as the rest of this batch: a foothold below the OS that reimaging does not remove.

Who can reach it

Local, through GRUB command processing on a node the attacker can already influence.

What to do

grub2 package update + reboot. This whole 2025 batch lands as one distro update - do it as a single pass rather than 20 separate changes, and remember to rebuild the netboot image.

References

Related entries

• GRUB2 (BFS filesystem parser): Integer overflow in the BeFS parser leads to heap corruptionCVE-2024-45778 · GRUB2 (BFS filesystem parser)Medium
• GRUB2 (tar filesystem parser): Integer overflow in the tarfs module writes out of boundsCVE-2024-45780 · GRUB2 (tar filesystem parser)Medium
• GRUB2 (UFS filesystem parser): Symlink name length is never validated, giving a heap out-of-bounds write in the UFSCVE-2024-45781 · GRUB2 (UFS filesystem parser)Medium
• Solidigm DC SSDs with TCG Opal (DC P4510/P4511/P4610 Opal, D5-P4320/P4326 Opal, D5-P5316 Opal, D7-P5510/P5520/P5620CVE-2024-47976 · Solidigm DC SSDs with TCG Opal (DC P4510/P4511/P4610 Opal, D5-P4320/P4326 Opal, D5-P5316 Opal, D7-P5510/P5520/P5620…Medium
• Dell iDRAC9 / iDRAC10 (path traversal): A high-privileged remote attacker traverses paths on the BMC filesystemCVE-2025-22397 · Dell iDRAC9 / iDRAC10 (path traversal)Medium
• IBM Power Systems host firmware: crafted service-processor command leaks protected registersCVE-2026-19321 · IBM Power Systems host firmware (service processor register access path)Medium