CVE-2025-61664: GRUB2 Bootloader Use After Free Vulnerability

CVE-2025-61664 Overview

CVE-2025-61664 is a Use-After-Free vulnerability in the GNU GRUB2 bootloader's normal module. The flaw exists because the normal_exit command is not properly unregistered when its parent module is unloaded. An attacker with local access to the bootloader can invoke the stale command after module removal, causing GRUB2 to dereference freed memory. Exploitation can crash the system or affect the confidentiality and integrity of data processed during boot. The issue is tracked under CWE-825: Expired Pointer Dereference and was published to the National Vulnerability Database on November 18, 2025.

Critical Impact
Local attackers with access to the GRUB2 command line can trigger memory corruption during the pre-boot environment, undermining boot integrity and potentially bypassing security controls that rely on the bootloader.

Affected Products

GNU GRUB2 bootloader — normal module
Linux distributions shipping affected GRUB2 builds (see Red Hat CVE-2025-61664)
Downstream vendor packages tracking the upstream GRUB2 codebase

Discovery Timeline

2025-11-18 - CVE-2025-61664 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2025-61664

Vulnerability Analysis

GRUB2 loads functionality through dynamically loadable modules. The normal module registers several commands, including normal_exit, which returns from the normal mode command interpreter. When the normal module is unloaded, the command registration for normal_exit is not removed from GRUB2's command dispatch table. The dispatch entry retains a pointer to code and data structures that have been freed during module teardown.

When an attacker subsequently invokes normal_exit, GRUB2 follows the stale pointer and executes against memory that is no longer valid. The resulting behavior depends on what has since been placed in that region: benign cases yield a boot-time crash, while adversarial layouts can produce information disclosure or corruption of bootloader state. Because GRUB2 runs before the operating system kernel and any runtime protections, memory safety failures at this stage carry direct implications for platform trust and Secure Boot chains.

Root Cause

The root cause is missing cleanup logic in the normal module's unload path. The command handler for normal_exit should be unregistered via GRUB2's command deregistration API when the module is removed, but this step is skipped. This leaves a dangling function pointer inside GRUB2's global command table, matching the classic CWE-825: Expired Pointer Dereference pattern.

Attack Vector

Exploitation requires local access to the GRUB2 command interface, typically through a physical console, a serial console, or a virtualization management interface. The attacker loads the normal module, unloads it, and then invokes the still-registered normal_exit command. Attack complexity is high because the outcome depends on the memory state at the time of invocation. See the upstream discussion on the GNU GRUB development list for further context.

No public proof-of-concept exploit has been published for CVE-2025-61664 at the time of writing.

Detection Methods for CVE-2025-61664

Indicators of Compromise

Unexpected GRUB2 crashes, resets, or hangs during boot or when interacting with the GRUB shell
Boot logs showing repeated module load and unload sequences for the normal module
Serial console or IPMI transcripts capturing invocations of normal_exit after rmmod normal

Detection Strategies

Inventory installed GRUB2 package versions across the fleet and compare against vendor advisories such as Red Hat CVE-2025-61664
Monitor firmware and bootloader integrity measurements reported through Trusted Platform Module (TPM) event logs for unexpected PCR changes
Correlate physical access events, remote console sessions, and BMC activity with unplanned reboots

Monitoring Recommendations

Forward journalctl -b boot records and MOK or Secure Boot state changes to a central log store for anomaly review
Alert on interactive GRUB2 shell entries in environments where the boot menu should be non-interactive
Track package management events for GRUB2 updates to confirm patch deployment across managed hosts

How to Mitigate CVE-2025-61664

Immediate Actions Required

Apply the GRUB2 update supplied by your Linux distribution as soon as it is available; monitor the Red Hat Bug Report #2414685 for status
Restrict physical and out-of-band console access to systems running affected GRUB2 builds
Enable a GRUB2 boot password to prevent unauthorized entry to the interactive command shell

Patch Information

Upstream fixes are being coordinated on the GNU GRUB development mailing list; see the GNU GRUB Development Discussion thread from November 2025. Distribution-specific packages should be tracked through vendor advisories such as Red Hat CVE-2025-61664. Apply the vendor-supplied grub2 package update and rebuild the boot configuration according to your distribution's guidance.

Workarounds

Configure a GRUB2 superuser and password using grub-mkpasswd-pbkdf2 to gate access to the interactive shell
Set GRUB_TIMEOUT=0 and disable the menu editor where operationally feasible to remove the interactive attack surface
Enforce Secure Boot and measured boot so that tampering with the GRUB2 environment produces detectable attestation failures

bash

# Configuration example: require a password to access the GRUB2 shell
# 1. Generate a PBKDF2 hash
grub-mkpasswd-pbkdf2

# 2. Add to /etc/grub.d/40_custom
set superusers="admin"
password_pbkdf2 admin grub.pbkdf2.sha512.10000.<HASH>

# 3. Rebuild the GRUB configuration
grub2-mkconfig -o /boot/grub2/grub.cfg