Database/Firmware, BMC & network fabric
GRUB2 (network config file search): grub_net_search_config_file copies a network-controlled variable with strcpy
Impact
grub_net_search_config_file copies a network-controlled variable with strcpy into a fixed buffer. This is the highest-priority entry in the 2025 batch for anyone running netboot: an attacker on the provisioning segment corrupts GRUB's memory during PXE and takes the node before the OS exists.
Who can reach it
Anyone who can respond on the network boot path - rogue DHCP server, compromised provisioning host, or a tenant that has been given L2 access to the provisioning VLAN by mistake.
What to do
grub2 package update + reboot, AND rebuild/replace the netboot GRUB binary served over TFTP/HTTP - the served image is the actual attack surface here and patching running nodes does not touch it. Segment the provisioning network away from tenant traffic.
References
Related entries
- Linux kernel (drivers/infiniband/hw/bnxt_re): The NVMe-oF target host panics the moment a client connects.CVE-2025-21885 · Linux kernel (drivers/infiniband/hw/bnxt_re)High
- Dell Enterprise SONiC OS 4.5.0 (SSH cryptographic key): The SSH cryptographic-key weakness recurring in EnterpriseCVE-2025-38741 · Dell Enterprise SONiC OS 4.5.0 (SSH cryptographic key)High
- Fujitsu / Fsas Technologies iRMC S6 BMC (M5-generation servers): A length-boundary bug in BMC authenticationCVE-2025-65002 · Fujitsu / Fsas Technologies iRMC S6 BMC (M5-generation servers)High
- IBM PowerVM partition firmware: malformed network-boot packet yields code execution inside the booting partitionCVE-2026-18821 · IBM PowerVM partition firmware (network boot packet handling)High
- Linux kernel NVMe-oF TCP target (nvmet-tcp, H2C_DATA PDU before CONNECT): Nvmet_tcp_build_pdu_iovec() dereferences cmdCVE-2026-22998 · Linux kernel NVMe-oF TCP target (nvmet-tcp, H2C_DATA PDU before CONNECT)High
- Linux kernel SoftiWARP receive path (siw_qp_rx, siw_tcp_rx_data header processing): When siw_get_hdr() rejects a headerCVE-2026-23242 · Linux kernel SoftiWARP receive path (siw_qp_rx, siw_tcp_rx_data header processing)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.