A flaw was found in GRUB2. The bootloader insufficiently validates memory addresses passed to the serial configuration command, allowing arbitrary system memory to be targeted instead of a legitimate serial communication device. A local attacker with control over GRUB's boot configuration can exploit this issue to overwrite internal verification structures. This vulnerability allows the attacker to bypass Secure Boot lockdown restrictions and load arbitrary unsigned modules during system boot.
Last checked: 2026-10-02 19:43 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-10-02 17:44 UTC)
Fix evidence last checked: 2026-10-04 14:36 UTC
Debian 12 (Bookworm)
Debian Security Tracker · Observed 2026-10-04