BaseFortify

Publication date: 2025-11-18

Last updated on: 2026-06-30

Assigner: Red Hat, Inc.

Description

A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the net_set_vlan command is not properly unregistered when the network module is unloaded from memory. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-18

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2025-11-18

EPSS Evaluated

2026-07-05

NVD

CVE-2025-54770

Affected Vendors & Products

Vendor	Product	Version / Range
gnu	grub	2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-825	The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.

Attack-Flow Graph

Executive Summary

This vulnerability is a Use-after-Free flaw in the GRUB2 bootloader's network module. It occurs because the net_set_vlan command is not properly unregistered when the network module is unloaded from memory. An attacker who can execute this command can cause the system to access invalid memory locations, leading to system instability and potentially causing the system to crash and become unavailable.

Impact Analysis

The vulnerability can cause a Denial of Service (DoS) by making the system unstable and potentially crashing it completely. This results in loss of system availability, which can disrupt operations and services relying on the affected system.

Hi! I’m here to help you understand CVE-2025-54770. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70