6.7
Medium
CVE-2024-2312 GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI…
Description
GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GRUB2 2.12 | earliest → < 2.12-1ubuntu5 | 2.12-1ubuntu5 |
| Debian based GNU GRUB 2.12 | earliest → < 2.12-1ubuntu5 | 2.12-1ubuntu5 |
Other CVEs of GRUB2
The 10 CVEs of GRUB2 →
CVE-2026-97876
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot…
6.4
Medium
CVE-2025-54770
Grub2: use-after-free in net_set_vlan
4.9
Medium
CVE-2025-61664
Grub2: missing unregister call for normal_exit command may lead to use-after-free
4.9
Medium
CVE-2025-61663
Grub2: missing unregister call for normal commands may lead to use-after-free
4.9
Medium