4.9 Medium

CVE-2025-61664 Grub2: missing unregister call for normal_exit command may lead to use-after-free

Description

A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity.

CVSS 3.1 detail

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitable with local access to the machine, without an account and without any user action; the impact on data or service is limited.

Attack vector: Local
Attack complexity: High
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: Low

Affected products and versions

Product	Affected versions	Fixed in
GRUB2 2.14	earliest → 2.14	No fix stated
Red Hat Enterprise Linux 10	Versions not published
Red Hat Enterprise Linux 7	Versions not published
Red Hat Enterprise Linux 8	Versions not published
Red Hat Enterprise Linux 9	Versions not published
Red Hat OpenShift Container Platform 4	Versions not published
Red Hat In-Vehicle Operating System 1	Versions not published

References

access.redhat.com access.redhat.com
RHBZ#2414685 bugzilla.redhat.com
lists.gnu.org lists.gnu.org

Timeline

Published November 18, 2025
Last modified November 5, 2026

The 10 CVEs of GRUB2 →

CVE-2026-97876 A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot… 6.4 Medium CVE-2025-54770 Grub2: use-after-free in net_set_vlan 4.9 Medium CVE-2025-61663 Grub2: missing unregister call for normal commands may lead to use-after-free 4.9 Medium CVE-2025-61662 A Use-After-Free vulnerability has been discovered in GRUB's gettext module 7.8 High

Track this CVE