GRUB2 (ReiserFS symlink handling): Same symlink integer-overflow pattern in the ReiserFS parser

Impact

Same symlink integer-overflow pattern in the ReiserFS parser - heap out-of-bounds write, pre-boot execution.

Who can reach it

Attacker-supplied ReiserFS image.

What to do

grub2 package update + reboot; or build without the module, since nothing in a modern GPU fleet boots ReiserFS.

References

Related entries

• GRUB2 (JFS symlink handling): Symlink integer overflow in the JFS parser producing a heap out-of-bounds writeCVE-2025-0685 · GRUB2 (JFS symlink handling)Medium
• GRUB2 (romfs symlink handling): Symlink integer overflow in the romfs parser producing a heap out-of-bounds writeCVE-2025-0686 · GRUB2 (romfs symlink handling)Medium
• GRUB2 (UDF filesystem parser): Heap buffer overflow in grub_udf_read_blockCVE-2025-0689 · GRUB2 (UDF filesystem parser)Medium
• GRUB2 (read command): Integer overflow in the read command's accumulator writes out of boundsCVE-2025-0690 · GRUB2 (read command)Medium
• GRUB2 (HFS filesystem parser): Integer overflow computing internal buffer sizes from HFS metadata, leading to a heapCVE-2025-1125 · GRUB2 (HFS filesystem parser)Medium
• Dell OMSA: authenticated SSRF lets a low-privileged user reach systems behind the agentCVE-2026-81443 · Dell OpenManage Server Administrator (SSRF, authenticated)Medium