CVE-2026-97876

A flaw was found in GRUB2. The bootloader insufficiently validates memory addresses passed to the serial configuration command, allowing arbitrary system memory to be targeted instead of a legitimate serial communication device. A local attacker with control over GRUB's boot configuration can exploit this issue to overwrite internal verification structures. This vulnerability allows the attacker to bypass Secure Boot lockdown restrictions and load arbitrary unsigned modules during system boot.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There is no complete mitigation for this issue other than applying a fixed GRUB build; the underlying fix requires validating the UART/MMIO resource used by the serial command and making the module-verification path fail closed when the verifier list is empty under lockdown.

Until a fixed build is available, exposure can be reduced by:

• Restricting who can modify or supply GRUB boot configuration (grub.cfg) and disallowing untrusted or attacker-controlled removable boot media.
• Avoiding use of the serial console/terminal_input during boot on systems relying on Secure Boot lockdown, where serial input is not otherwise required.
• Treating administrator-level control over boot configuration as equivalent to the ability to bypass lockdown module verification on affected GRUB builds, and applying the same access controls accordingly.

These steps reduce the attack surface but do not close the underlying validation flaw; they do not help if the attacker already controls boot configuration or removable boot media.