A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity.

An update of the grub2 package has been released.

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs     because the bootloader mishandles string conversion when reading information from a USB device, allowing     an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured     USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to     crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity     of the exploit the impact is most likely limited.(CVE-2025-61661)

    A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a     programming error where the gettext command remains registered in memory after its module is unloaded. An     attacker can exploit this condition by invoking the orphaned command, causing the application to access a     memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to     crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not     discarded.(CVE-2025-61662)

    A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use     After Free issue, occurs because the normal_exit command is not properly unregistered when its related     module is unloaded. An attacker can exploit this condition by invoking the command after the module has     been removed, causing the system to improperly access a previously freed memory location. This leads to a     system crash or possible impacts in data confidentiality and integrity.(CVE-2025-61664)

    A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate     Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is     not properly unregistered when the module is unloaded. An attacker who can execute this command can force     the system to access memory locations that are no longer valid. Successful exploitation leads directly to     system instability, which can result in a complete crash and halt system availability. Impact on the data     integrity and confidentiality is also not discarded.(CVE-2025-61663)

Tenable has extracted the preceding description block directly from the EulerOS grub2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1342 advisory.

    A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate     Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the net_set_vlan command     is not properly unregistered when the network module is unloaded from memory. An attacker who can execute     this command can force the system to access memory locations that are no longer valid. Successful     exploitation leads directly to system instability, which can result in a complete crash and halt system     availability (CVE-2025-54770)

    A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw     occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference     to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading     to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.
    (CVE-2025-54771)

    A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs     because the bootloader mishandles string conversion when reading information from a USB device, allowing     an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured     USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to     crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity     of the exploit the impact is most likely limited. (CVE-2025-61661)

    A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a     programming error where the gettext command remains registered in memory after its module is unloaded. An     attacker can exploit this condition by invoking the orphaned command, causing the application to access a     memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to     crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not     discarded. (CVE-2025-61662)

    A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate     Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is     not properly unregistered when the module is unloaded. An attacker who can execute this command can force     the system to access memory locations that are no longer valid. Successful exploitation leads directly to     system instability, which can result in a complete crash and halt system availability. Impact on the data     integrity and confidentiality is also not discarded. (CVE-2025-61663)

    A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use     After Free issue, occurs because the normal_exit command is not properly unregistered when its related     module is unloaded. An attacker can exploit this condition by invoking the command after the module has     been removed, causing the system to improperly access a previously freed memory location. This leads to a     system crash or possible impacts in data confidentiality and integrity. (CVE-2025-61664)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of grub2 installed on the remote host is prior to 2.06-14. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3107 advisory.

    A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate     Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the net_set_vlan command     is not properly unregistered when the network module is unloaded from memory. An attacker who can execute     this command can force the system to access memory locations that are no longer valid. Successful     exploitation leads directly to system instability, which can result in a complete crash and halt system     availability (CVE-2025-54770)

    A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs     because the bootloader mishandles string conversion when reading information from a USB device, allowing     an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured     USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to     crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity     of the exploit the impact is most likely limited. (CVE-2025-61661)

    A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a     programming error where the gettext command remains registered in memory after its module is unloaded. An     attacker can exploit this condition by invoking the orphaned command, causing the application to access a     memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to     crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not     discarded. (CVE-2025-61662)

    A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate     Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is     not properly unregistered when the module is unloaded. An attacker who can execute this command can force     the system to access memory locations that are no longer valid. Successful exploitation leads directly to     system instability, which can result in a complete crash and halt system availability. Impact on the data     integrity and confidentiality is also not discarded. (CVE-2025-61663)

    A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use     After Free issue, occurs because the normal_exit command is not properly unregistered when its related     module is unloaded. An attacker can exploit this condition by invoking the command after the module has     been removed, causing the system to improperly access a previously freed memory location. This leads to a     system crash or possible impacts in data confidentiality and integrity. (CVE-2025-61664)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:21212-1 advisory.

    Changes in grub2:

    - CVE-2025-54771: Fixed grub_file_close() does not properly controls the fs refcount (bsc#1252931)
    - CVE-2025-54770: Fixed missing unregister call for net_set_vlan command may lead to use-after-free     (bsc#1252930)
    - CVE-2025-61662: Fixed missing unregister call for gettext command may lead to use-after-free     (bsc#1252933)
    - CVE-2025-61663: Fixed missing unregister call for normal commands may lead to use-after-free     (bsc#1252934)
    - CVE-2025-61664: Fixed missing unregister call for normal_exit command may lead to use-after-free     (bsc#1252935)
    - CVE-2025-61661: Fixed out-of-bounds write in grub_usb_get_string() function (bsc#1252932)

    - Bump upstream SBAT generation to 6

    - Fix sparse file not allowed error after grub2-reboot (bsc#1245738)
    - Fix PowerPC network boot prefix to correctly locate grub.cfg (bsc#1249385)
    - turn off page flipping for i386-pc using VBE video backend (bsc#1245636)
    - Fix boot hangs in setting up serial console when ACPI SPCR table is present       and redirection is disabled (bsc#1249088)
    - Fix timeout when loading initrd via http after PPC CAS reboot (bsc#1245953)
    - Skip mount point in grub_find_device function (bsc#1246231)

    - CVE-2024-56738: Fixed side-channel attack due to not constant-time algorithm in grub_crypto_memcmp     (bsc#1234959)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025:20163-1 advisory.

    Changes in grub2:

    - CVE-2025-54771: Fixed grub_file_close() does not properly controls the fs refcount (bsc#1252931)
    - CVE-2025-54770: Fixed missing unregister call for net_set_vlan command may lead to use-after-free     (bsc#1252930)
    - CVE-2025-61662: Fixed missing unregister call for gettext command may lead to use-after-free     (bsc#1252933)
    - CVE-2025-61663: Fixed missing unregister call for normal commands may lead to use-after-free     (bsc#1252934)
    - CVE-2025-61664: Fixed missing unregister call for normal_exit command may lead to use-after-free     (bsc#1252935)
    - CVE-2025-61661: Fixed out-of-bounds write in grub_usb_get_string() function (bsc#1252932)

    - Bump upstream SBAT generation to 6

    - Fix sparse file not allowed error after grub2-reboot (bsc#1245738)
    - Fix PowerPC network boot prefix to correctly locate grub.cfg (bsc#1249385)
    - turn off page flipping for i386-pc using VBE video backend (bsc#1245636)
    - Fix boot hangs in setting up serial console when ACPI SPCR table is present       and redirection is disabled (bsc#1249088)
    - Fix timeout when loading initrd via http after PPC CAS reboot (bsc#1245953)
    - Skip mount point in grub_find_device function (bsc#1246231)

    - CVE-2024-56738: Fixed side-channel attack due to not constant-time algorithm in grub_crypto_memcmp     (bsc#1234959)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4305-1 advisory.

    - CVE-2025-54771: Fixed rub_file_close() does not properly controls the fs refcount (bsc#1252931)
    - CVE-2025-54770: Fixed missing unregister call for net_set_vlan command may lead to use-after-free     (bsc#1252930)
    - CVE-2025-61662: Fixed missing unregister call for gettext command may lead to use-after-free     (bsc#1252933)
    - CVE-2025-61663: Fixed missing unregister call for normal commands may lead to use-after-free     (bsc#1252934)
    - CVE-2025-61664: Fixed missing unregister call for normal_exit command may lead to use-after-free     (bsc#1252935)
    - CVE-2025-61661: Fixed out-of-bounds write in grub_usb_get_string() function (bsc#1252932)

    Other fixes:

    - Bump upstream SBAT generation to 6
    - Fixed timeout when loading initrd via http after PPC CAS reboot (bsc#1245953)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4197-1 advisory.

    - CVE-2025-54771: Fixed rub_file_close() does not properly controls the fs refcount (bsc#1252931)
    - CVE-2025-61661: Fixed out-of-bounds write in grub_usb_get_string() function (bsc#1252932)
    - CVE-2025-61662: Fixed missing unregister call for gettext command may lead to use-after-free     (bsc#1252933)
    - CVE-2025-61663: Fixed missing unregister call for normal commands may lead to use-after-free     (bsc#1252934)
    - CVE-2025-61664: Fixed missing unregister call for normal_exit command may lead to use-after-free     (bsc#1252935)

    Other fixes:

    - Bump upstream SBAT generation to 6

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4196-1 advisory.

    - CVE-2025-54770: Fixed missing unregister call for net_set_vlan command may lead to use-after-free     (bsc#1252930)
    - CVE-2025-54771: Fixed rub_file_close() does not properly controls the fs refcount (bsc#1252931)
    - CVE-2025-61661: Fixed out-of-bounds write in grub_usb_get_string() function (bsc#1252932)
    - CVE-2025-61662: Fixed missing unregister call for gettext command may lead to use-after-free     (bsc#1252933)
    - CVE-2025-61663: Fixed missing unregister call for normal commands may lead to use-after-free     (bsc#1252934)
    - CVE-2025-61664: Fixed missing unregister call for normal_exit command may lead to use-after-free     (bsc#1252935)

    Other fixes:

    - Bump upstream SBAT generation to 6
    - Fix timeout when loading initrd via http after PPC CAS reboot (bsc#1245953)
    - Fix PPC CAS reboot failure work when initiated via submenu (bsc#1241132)
    - Fix out of memory issue on PowerPC by increasing RMA size (bsc#1236744, bsc#1252269)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use     After Free issue, occurs because the normal_exit command is not properly unregistered when its related     module is unloaded. An attacker can exploit this condition by invoking the command after the module has     been removed, causing the system to improperly access a previously freed memory location. This leads to a     system crash or possible impacts in data confidentiality and integrity. (CVE-2025-61664)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
297822	Photon OS 4.0: Grub2 PHSA-2026-4.0-0950	Nessus	PhotonOS Local Security Checks	high
297605	EulerOS 2.0 SP13 : grub2 (EulerOS-SA-2026-1210)	Nessus	Huawei Local Security Checks	medium
297586	EulerOS 2.0 SP13 : grub2 (EulerOS-SA-2026-1222)	Nessus	Huawei Local Security Checks	medium
297238	Photon OS 5.0: Grub2 PHSA-2026-5.0-0742	Nessus	PhotonOS Local Security Checks	high
282374	Amazon Linux 2023 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2023-2025-1342)	Nessus	Amazon Linux Local Security Checks	medium
281776	Amazon Linux 2 : grub2, --advisory ALAS2-2025-3107 (ALAS-2025-3107)	Nessus	Amazon Linux Local Security Checks	medium
279373	SUSE SLES16 Security Update : grub2 (SUSE-SU-2025:21212-1)	Nessus	SuSE Local Security Checks	medium
279059	openSUSE 16 Security Update : grub2 (openSUSE-SU-2025:20163-1)	Nessus	SuSE Local Security Checks	medium
277249	SUSE SLED15 / SLES15 Security Update : grub2 (SUSE-SU-2025:4305-1)	Nessus	SuSE Local Security Checks	medium
276907	SUSE SLES12 Security Update : grub2 (SUSE-SU-2025:4197-1)	Nessus	SuSE Local Security Checks	medium
276809	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : grub2 (SUSE-SU-2025:4196-1)	Nessus	SuSE Local Security Checks	medium
275740	Linux Distros Unpatched Vulnerability : CVE-2025-61664	Nessus	Misc.	high

Detections

Analytics

CVE-2025-61664

medium

Tenable Plugins

high

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

high