CVE-2025-54770: GRUB2 Bootloader Use-after-Free DoS Flaw

CVE-2025-54770 Overview

CVE-2025-54770 is a use-after-free vulnerability in the GNU GRUB2 bootloader's network module. The flaw exists because the net_set_vlan command is not properly unregistered when the network module is unloaded from memory. An attacker who can execute this command forces the system to dereference memory locations that are no longer valid. Successful exploitation leads to system instability and can crash the bootloader, halting availability of the affected system. The issue is tracked under CWE-825: Expired Pointer Dereference and was published to the National Vulnerability Database on November 18, 2025.

Critical Impact
Local attackers with access to the GRUB2 command line can trigger a use-after-free that crashes the bootloader and prevents the system from completing boot.

Affected Products

GNU GRUB2 bootloader (network module)
Linux distributions shipping affected GRUB2 builds, including Red Hat Enterprise Linux (see Red Hat CVE-2025-54770 Advisory)
Systems using GRUB2 network boot features that expose the net_set_vlan command

Discovery Timeline

2025-11-18 - CVE-2025-54770 published to NVD and discussed on the OpenWall OSS Security list
2025-11-18 - Fix coordination posted on the GNU GRUB development mailing list
2026-09-01 - Last updated in the NVD database

Technical Details for CVE-2025-54770

Vulnerability Analysis

The vulnerability resides in GRUB2's network subsystem. GRUB2 exposes a dynamic command interface where modules can register commands at load time and must unregister them at unload time. The network module registers the net_set_vlan command, which configures a VLAN tag for network boot operations. When the module is unloaded from memory, the command handler for net_set_vlan is left registered. The command table continues to reference function pointers and data structures that belonged to the freed module image.

If a user or script subsequently invokes net_set_vlan, GRUB2 dispatches execution to the stale pointer. The bootloader then reads or executes memory that is no longer valid, producing undefined behavior. In GRUB2's single-address-space runtime, this reliably destabilizes the boot environment and can halt the boot process. See the Red Hat Bug Report #2413813 for upstream analysis.

Root Cause

The root cause is an incomplete cleanup path in the network module's unload routine. The module registers net_set_vlan but does not call the corresponding unregister function during teardown. The command remains in GRUB2's global command list after the backing code and data have been freed, satisfying the conditions for an expired pointer dereference under [CWE-825].

Attack Vector

Exploitation requires local access to the GRUB2 command line or a GRUB2 configuration path that invokes net_set_vlan after the network module has been unloaded. The attack vector is local and non-authenticated at the firmware or bootloader stage. There is no evidence of in-the-wild exploitation, and no public proof-of-concept is listed in NVD references at this time. The practical impact is limited to denial of service during boot rather than code execution or privilege escalation.

Detection Methods for CVE-2025-54770

Indicators of Compromise

Repeated boot failures or GRUB2 crashes immediately after invocation of net_set_vlan from the GRUB2 shell or configuration files.
Unexpected changes to /boot/grub2/grub.cfg or custom GRUB2 scripts that add net_set_vlan after an rmmod net sequence.
Systems hanging at the GRUB2 prompt with no console output beyond a bootloader fault.

Detection Strategies

Audit GRUB2 configuration files and user-supplied boot scripts for sequences that unload the network module and later reference VLAN commands.
Monitor package inventory to identify hosts running GRUB2 versions that predate the upstream fix referenced in the GNU GRUB development message.
Correlate hardware console telemetry and out-of-band management logs with unexpected reboots to surface bootloader-level crashes.

Monitoring Recommendations

Collect and centralize baseboard management controller (BMC) and iLO/iDRAC console logs to capture GRUB2 fault output.
Alert on unauthorized modifications to /etc/default/grub, /boot/grub2/, and PXE boot server configurations.
Track GRUB2 package versions across the fleet and flag hosts missing the vendor-provided update.

How to Mitigate CVE-2025-54770

Immediate Actions Required

Apply the GRUB2 security update from your Linux distribution as soon as it is available. Red Hat customers should track the Red Hat CVE-2025-54770 Advisory for errata status.
Restrict physical and remote console access to systems where attackers could reach the GRUB2 command line.
Enable a GRUB2 password to prevent unauthorized interactive use of bootloader commands such as net_set_vlan.

Patch Information

The fix adds the missing unregister call for net_set_vlan in the network module's unload path, ensuring the command is removed from GRUB2's command table before the module memory is freed. Distribution-specific patched packages are being published by downstream vendors; refer to the Red Hat Bug Report #2413813 and the GNU GRUB development message for upstream patch details.

Workarounds

Disable or remove the GRUB2 network module on systems that do not require network boot functionality.
Set a GRUB2 superuser password using grub2-setpassword to block unauthenticated command-line access to bootloader commands.
Avoid issuing rmmod net followed by any net_* command in GRUB2 scripts until the patched package is deployed.

bash

# Configuration example: set a GRUB2 superuser password and regenerate config
grub2-setpassword
grub2-mkconfig -o /boot/grub2/grub.cfg