Dashboard / CVE-2025-54770

CVE-2025-54770

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 35/100
Published: 2025-11-18 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

No Auth No Interaction

CVSS Vector Breakdown

AV: Local
AC: High
PR: None
UI: None
S: Unchanged
C: Low
I: Low
A: Low

Description

A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the net_set_vlan command is not properly unregistered when the network module is unloaded from memory. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
GNU grub2 0

References & Advisories (4)

https://bugzilla.redhat.com/show_bug.cgi?id=2413813
issue-tracking x_refsource_REDHAT

Bug Bounty Relevance

35 / 100
✓ No authentication
✓ No user interaction

CVSS Score

4.9 / 10.0 v3.1
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS — Exploitation Probability

0.16%
Raw Score 0.001580
Percentile 4.9%
Date 2026-11-05

Intelligence Sources

mitre ref →
nvd ref →

External Links