SUSE-SU-2026:21621-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-202621621-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21621-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:21621-1
Upstream
CVE (6)
Related
CVE (6)
Published
2026-05-11T08:48:36Z
Modified
2026-05-16T18:24:43Z
Summary
Security update for grub2
Details

This update for grub2 fixes the following issues

  • CVE-2025-54770: Missing unregister call for net_set_vlan command may lead to use-after-free (bsc#1252930).
  • CVE-2025-54771: grub_file_close() does not properly controls the fs refcount (bsc#1252931).
  • CVE-2025-61661: Out-of-bounds write in grub_usb_get_string() function (bsc#1252932).
  • CVE-2025-61662: Missing unregister call for gettext command may lead to use-after-free (bsc#1252933).
  • CVE-2025-61663: Missing unregister call for normal commands may lead to use-after-free (bsc#1252934).
  • CVE-2025-61664: Missing unregister call for normal_exit command may lead to use-after-free (bsc#1252935).

Changes for grub2:

  • Bump upstream SBAT generation to 6
References

Affected packages