CVE-2026-97876

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97876", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-09-25T08:49:34.867Z", "datePublished": "2026-10-02T10:34:23.314Z", "dateUpdated": "2026-10-02T17:45:06.705Z"}, "containers": {"cna": {"title": "Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-822", "description": "CWE-822 Untrusted pointer dereference", "type": "CWE"}]}], "affected": [{"vendor": "GNU", "product": "grub2", "versions": [{"status": "affected", "version": "2.12", "lessThan": "2.16", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled.\n\n\n\n\nThe vulnerability is caused by insufficient validation of the MMIO base address passed to the GRUB serial command. GRUB does not validate that the base address corresponds to a UART device, rather than being an arbitrary memory address. This allows an attacker to trick GRUB into writing non-arbitrary data at an attacker-controlled address, including resetting\u00a0the grub_file_verifiers list in a way that disables the subsequent verification of loaded modules."}], "references": [{"url": "https://www.openwall.com/lists/oss-security/2026/09/13/5", "tags": ["mailing-list"]}, {"url": "https://gitlab.freedesktop.org/gnu-grub/grub/-/commit/26beaa3b2720fefdc4d04c1ae209b776fe6848d6", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.4, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Le\u00efth Essid", "type": "reporter"}, {"lang": "en", "value": "Andrew Hamilton", "type": "remediation developer"}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-10-02T10:34:23.314Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-02T17:44:52.729699Z", "id": "CVE-2026-97876", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-02T17:45:06.705Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-97876", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-02T17:44:52.729699Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-02T17:44:59.967Z"}}], "cna": {"title": "Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address", "credits": [{"lang": "en", "type": "reporter", "value": "Le\u00efth Essid"}, {"lang": "en", "type": "remediation developer", "value": "Andrew Hamilton"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GNU", "product": "grub2", "versions": [{"status": "affected", "version": "2.12", "lessThan": "2.16", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.openwall.com/lists/oss-security/2026/09/13/5", "tags": ["mailing-list"]}, {"url": "https://gitlab.freedesktop.org/gnu-grub/grub/-/commit/26beaa3b2720fefdc4d04c1ae209b776fe6848d6", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled.\n\n\n\n\nThe vulnerability is caused by insufficient validation of the MMIO base address passed to the GRUB serial command. GRUB does not validate that the base address corresponds to a UART device, rather than being an arbitrary memory address. This allows an attacker to trick GRUB into writing non-arbitrary data at an attacker-controlled address, including resetting\u00a0the grub_file_verifiers list in a way that disables the subsequent verification of loaded modules."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-822", "description": "CWE-822 Untrusted pointer dereference"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-10-02T10:34:23.314Z"}}}, "cveMetadata": {"cveId": "CVE-2026-97876", "state": "PUBLISHED", "dateUpdated": "2026-10-02T17:45:06.705Z", "dateReserved": "2026-09-25T08:49:34.867Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2026-10-02T10:34:23.314Z", "assignerShortName": "canonical"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "grub2", "vendor": "GNU", "versions": [{"lessThan": "2.16", "status": "affected", "version": "2.12", "versionType": "semver"}]}], "source": "security@ubuntu.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled.\n\n\n\n\nThe vulnerability is caused by insufficient validation of the MMIO base address passed to the GRUB serial command. GRUB does not validate that the base address corresponds to a UART device, rather than being an arbitrary memory address. This allows an attacker to trick GRUB into writing non-arbitrary data at an attacker-controlled address, including resetting\u00a0the grub_file_verifiers list in a way that disables the subsequent verification of loaded modules."}], "id": "CVE-2026-97876", "lastModified": "2026-10-02T18:44:11.270", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 5.9, "source": "security@ubuntu.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-97876", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-02T17:44:52.729699Z", "version": "2.0.3"}}]}, "published": "2026-10-02T11:17:39.727", "references": [{"source": "security@ubuntu.com", "url": "https://gitlab.freedesktop.org/gnu-grub/grub/-/commit/26beaa3b2720fefdc4d04c1ae209b776fe6848d6"}, {"source": "security@ubuntu.com", "url": "https://www.openwall.com/lists/oss-security/2026/09/13/5"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-822"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{"bugzilla": {"description": "grub2: grub2: Secure Boot lockdown bypass via improper serial address validation", "id": "2545014", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545014"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-822", "details": ["A flaw was found in GRUB2. The bootloader insufficiently validates memory addresses passed to the serial configuration command, allowing arbitrary system memory to be targeted instead of a legitimate serial communication device. A local attacker with control over GRUB's boot configuration can exploit this issue to overwrite internal verification structures. This vulnerability allows the attacker to bypass Secure Boot lockdown restrictions and load arbitrary unsigned modules during system boot."], "name": "CVE-2026-97876", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grub2", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "grub2", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "grub2", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "grub2", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-02T10:34:23Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97876\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97876\nhttps://gitlab.freedesktop.org/gnu-grub/grub/-/commit/26beaa3b2720fefdc4d04c1ae209b776fe6848d6\nhttps://www.openwall.com/lists/oss-security/2026/09/13/5"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.12,2.16)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "grub2", "source": "cna", "vendor": "GNU"}, "product": "grub2", "vendor": "gnu"}], "created": "2026-10-02T11:30:17.828784+00:00", "updated": "2026-10-02T12:00:15.332817+00:00", "vendors": ["gnu", "gnu$PRODUCT$grub2"]}