CVE-2025-61661: GRUB Bootloader USB DoS Vulnerability

CVE-2025-61661 Overview

CVE-2025-61661 affects the GRUB (Grand Unified Bootloader) component. The flaw resides in how GRUB handles string conversion when reading information from a USB device during boot. Inconsistent length values are mishandled, resulting in an incorrect memory allocation size [CWE-131]. An attacker with physical access can connect a maliciously configured USB device during the boot sequence to trigger the condition. Successful exploitation causes GRUB to crash, producing a Denial of Service. Data corruption is theoretically possible, but the exploit complexity limits practical impact.

Critical Impact
A local attacker with physical access can crash GRUB at boot by attaching a crafted USB device, preventing system startup and potentially corrupting data.

Affected Products

GRUB (Grand Unified Bootloader) — USB device handling code path
Red Hat Enterprise Linux distributions shipping affected GRUB builds (see Red Hat advisory)
Downstream Linux distributions bundling the vulnerable GRUB component

Discovery Timeline

2025-11-18 - CVE-2025-61661 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2025-61661

Vulnerability Analysis

The vulnerability is classified as an Incorrect Calculation of Buffer Size [CWE-131]. GRUB performs string conversion while parsing information returned by an attached USB device. The conversion routine relies on length values supplied or derived from the device response. When those length values are inconsistent, GRUB computes an incorrect buffer size for the conversion operation.

The mismatch between the allocated buffer and the actual data written or read leads to memory handling errors inside the bootloader. GRUB executes before the operating system kernel, so a fault in this path halts the boot process. The primary observable impact is a bootloader crash producing a Denial of Service on the affected machine.

Data corruption is listed as a secondary theoretical outcome. Achieving controlled corruption requires precise manipulation of USB descriptor length fields and knowledge of GRUB's memory layout, which raises exploit complexity.

Root Cause

The root cause is the bootloader's trust in length metadata returned by an attached USB device without reconciling inconsistent values before allocation. This produces an undersized or mis-sized buffer during string conversion, violating the invariants expected by later processing.

Attack Vector

Exploitation requires physical presence at the target machine. The attacker connects a USB device programmed to return crafted descriptor or string data during the pre-boot USB enumeration performed by GRUB. No credentials, user interaction from a legitimate user, or network access is required.

The vulnerability is not exploitable remotely and there is no evidence of exploitation in the wild. No public proof-of-concept is available at the time of publication.

No verified proof-of-concept code is available. See the
[Red Hat CVE-2025-61661 Advisory](https://access.redhat.com/security/cve/CVE-2025-61661)
and [Red Hat Bug Report #2413827](https://bugzilla.redhat.com/show_bug.cgi?id=2413827)
for technical details as they are published.

Detection Methods for CVE-2025-61661

Indicators of Compromise

Unexpected GRUB crashes, hangs, or grub rescue> prompts observed at system boot.
Firmware or platform logs recording USB enumeration failures immediately before boot failure.
Unattended systems booting to abnormal states after physical access windows.

Detection Strategies

Monitor endpoint boot health telemetry for repeated boot failures or bootloader panics across managed systems.
Correlate physical access events, such as badge or console logs, with subsequent boot anomalies on the same host.
Track hardware inventory changes and unexpected USB device insertions on servers and kiosks.

Monitoring Recommendations

Enable USB device connection auditing where the operating system supports it and forward events to centralized logging.
Alert on hosts that fail to complete boot within expected windows after a hardware event.
Review IPMI, BMC, and out-of-band management logs for boot cycle anomalies on affected fleets.

How to Mitigate CVE-2025-61661

Immediate Actions Required

Apply the GRUB security update from your Linux distribution vendor once released. Track the Red Hat CVE-2025-61661 Advisory for fix availability.
Restrict physical access to systems running vulnerable GRUB builds, particularly servers, kiosks, and unattended endpoints.
Inventory systems using GRUB and prioritize patching for hosts in locations with limited physical security controls.

Patch Information

Refer to the Red Hat CVE-2025-61661 Advisory and Red Hat Bug Report #2413827 for downstream patch status. Additional discussion is available on the Openwall OSS-Security list. Apply distribution updates through the standard package manager once vendors publish fixed GRUB packages.

Workarounds

Disable USB boot support in UEFI or BIOS firmware settings where operational requirements permit.
Enforce firmware passwords and boot order restrictions so untrusted USB devices are not enumerated by GRUB.
Use chassis intrusion detection and physical locks on server hardware to reduce opportunity for USB-based attacks.

bash

# Example: rebuild GRUB configuration after applying vendor updates
sudo dnf update grub2-* shim-*
sudo grub2-mkconfig -o /boot/grub2/grub.cfg
# On UEFI systems:
sudo grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg