CVE-2025-61663: Grub2: missing unregister call for normal commands may lead to use-after-free
A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded.
Other sources
Grub2: missing unregister call for normal commands may lead to use-after-free
— Microsoft
The normal command is registered in the normal module during load. However, the command is not unregistered at the module unload. So, this may lead to use-after-free issue when the normal command is invoked after the normal module unload.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61663?
CVE-2025-61663 has been classified as a high severity vulnerability due to its potential to cause Denial of Service (DoS).
How do I fix CVE-2025-61663?
To mitigate CVE-2025-61663, update the GRUB2 bootloader to the latest version where the vulnerability has been patched.
What impact does CVE-2025-61663 have on my system?
CVE-2025-61663 can lead to a Denial of Service by allowing an attacker to exploit the Use-after-Free flaw in GRUB2.
Which versions of GRUB2 are affected by CVE-2025-61663?
CVE-2025-61663 affects the GRUB2 bootloader, but specific affected versions are not detailed in the vulnerability report.
Is CVE-2025-61663 a zero-day vulnerability?
CVE-2025-61663 is not classified as a zero-day vulnerability as it has been publicly disclosed along with potential mitigation steps.