CVE-2026-97876
published 2026-10-02CVE-2026-97876: A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while…
PriorityP334medium6.4CVSS 3.1
AVLACHPRHUINSUCHIHAH
EPSS
0.11%
1.4th percentile
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled.
The vulnerability is caused by insufficient validation of the MMIO base address passed to the GRUB serial command. GRUB does not validate that the base address corresponds to a UART device, rather than being an arbitrary memory address. This allows an attacker to trick GRUB into writing non-arbitrary data at an attacker-controlled address, including resetting the grub_file_verifiers list in a way that disables the subsequent verification of loaded modules.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | grub2 | — | — |
| gnu | grub2 | >= 2.12 < 2.16 | 2.16 |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
CVSS provenance
nvdv3.16.4MEDIUMCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_redhat6.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enab
ghsa_unreviewed·2026-10-02
CVE-2026-97876 [MEDIUM] CWE-822 A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enab
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled.
The vulnerability is caused by insufficient validation of the MMIO base address passed to the GRUB serial command. GRUB does not validate that the base address corresponds to a UART device, rather than being an arbitrary memory address. This allows an attacker to trick GRUB into writing non-arbitrary data at an attacker-controlled address, including resetting the grub_file_verifiers list in a way that disables the subsequent verification of loaded modules.
Red Hat
grub2: grub2: Secure Boot lockdown bypass via improper serial address validation
vendor_redhat·2026-10-02·CVSS 6.4
CVE-2026-97876 [MEDIUM] CWE-822 grub2: grub2: Secure Boot lockdown bypass via improper serial address validation
grub2: grub2: Secure Boot lockdown bypass via improper serial address validation
A flaw was found in GRUB2. The bootloader insufficiently validates memory addresses passed to the serial configuration command, allowing arbitrary system memory to be targeted instead of a legitimate serial communication device. A local attacker with control over GRUB's boot configuration can exploit this issue to overwrite internal verification structures. This vulnerability allows the attacker to bypass Secure Boot lockdown restrictions and load arbitrary unsigned modules during system boot.
Package: grub2 (Red Hat Enterprise Linux 10) - Fix deferred
Package: grub2 (Red Hat Enterprise Linux 7) - Fix deferred
Package: grub2 (Red Hat Enterprise Linux 8) - Fix deferred
Package: grub2 (Red Hat Enterprise Li
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-97876 radare2: grub2: Secure Boot lockdown bypass via improper serial address validation [epel-all]
bugzilla·2026-10-08·CVSS 6.4
CVE-2026-97876 [MEDIUM] CVE-2026-97876 radare2: grub2: Secure Boot lockdown bypass via improper serial address validation [epel-all]
CVE-2026-97876 radare2: grub2: Secure Boot lockdown bypass via improper serial address validation [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled.
The vulnerability is caused by insufficient validation of the MMIO base address passed to the GRUB serial command (grub-core/term/serial.c and grub-core/term/ns8250.c). When the serial command is invoked with --port=mmio,.q, the supplied 64-bit address is pas
Bugzilla
CVE-2026-97876 radare2: grub2: Secure Boot lockdown bypass via improper serial address validation [fedora-all]
bugzilla·2026-10-08·CVSS 6.4
CVE-2026-97876 [MEDIUM] CVE-2026-97876 radare2: grub2: Secure Boot lockdown bypass via improper serial address validation [fedora-all]
CVE-2026-97876 radare2: grub2: Secure Boot lockdown bypass via improper serial address validation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled.
The vulnerability is caused by insufficient validation of the MMIO base address passed to the GRUB serial command (grub-core/term/serial.c and grub-core/term/ns8250.c). When the serial command is invoked with --port=mmio,.q, the supplied 64-bit address is p
Bugzilla
CVE-2026-97876 grub2: grub2: Secure Boot lockdown bypass via improper serial address validation [fedora-all]
bugzilla·2026-10-08·CVSS 6.4
CVE-2026-97876 [MEDIUM] CVE-2026-97876 grub2: grub2: Secure Boot lockdown bypass via improper serial address validation [fedora-all]
CVE-2026-97876 grub2: grub2: Secure Boot lockdown bypass via improper serial address validation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled.
The vulnerability is caused by insufficient validation of the MMIO base address passed to the GRUB serial command (grub-core/term/serial.c and grub-core/term/ns8250.c). When the serial command is invoked with --port=mmio,.q, the supplied 64-bit address is pas
Bugzilla
CVE-2026-97876 grub2: grub2: Secure Boot lockdown bypass via improper serial address validation
bugzilla·2026-10-02·CVSS 6.4
CVE-2026-97876 [MEDIUM] CVE-2026-97876 grub2: grub2: Secure Boot lockdown bypass via improper serial address validation
CVE-2026-97876 grub2: grub2: Secure Boot lockdown bypass via improper serial address validation
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled.
The vulnerability is caused by insufficient validation of the MMIO base address passed to the GRUB serial command. GRUB does not validate that the base address corresponds to a UART device, rather than being an arbitrary memory address. This allows an attacker to trick GRUB into writing non-arbitrary data at an attacker-controlled address, including resetting the grub_file_verifiers list in a way that disables the subsequent verification of loaded modules.
2026-10-02
Published