Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:grub2 User: [email protected] Usertags: pu
Hey folks,
We have some security fixes for grub2 that I'd like to get into the
next trixie point release please. There are a bunch of CVE fixes
backported from upstream, plus a matching bump in SBAT level from
grub,5 to grub,7 that will be needed. The last change in particular is
needed to fix a known Secure Boot bypass bug.
Changelog:
grub2 (2.12-9+deb13u3) trixie; urgency=medium
[ Fabian Grünbichler ]
* Patches for November 2025 CVEs
+ CVE-2025-54770: a use-after-free issue in the network module's
VLAN handling code that can be used to trigger a denial of
service
+ CVE-2025-54771: a use-after-free issue when closing a file which
can be used to trigger at least a denial of service
+ CVE-2025-61661: mishandling of string conversion when reading data from a
(malicious) USB device, which can be used to trigger at least a denial of
service
+ CVE-2025-61662: a use-after-free issue in the gettext module,
which can be used to trigger at least a denial of service
+ CVE-2025-61663/CVE-2025-61664: two use-after-free issues when
unloading the `normal` module, which can be used to trigger at
least a denial of service
+ Bump SBAT to grub,6 to match.
* Patches for September 2026 CVE
+ CVE-2026-97876: serial MMIO secure boot bypass
+ Bump SBAT to grub,7 to match.
-- Steve McIntyre <[email protected]> Thu, 05 Nov 2026 12:17:08 +0000
Full debdiff is attached.
grub2_2.12-9+deb13u3.debdiff.gz
Description: application/gzip
