Loading story…
GRUB2 maintainers released a 73-patch security update bundle addressing 21 disclosed vulnerabilities across filesystem parsers, gettext, JPEG parsing, networking, GPG hooks, command handling, and module unloading. The flaws include heap out-of-bounds reads and writes, integer overflows, use-after-free conditions, information disclosure, denial of service, and potential arbitrary code execution. Oracle disclosed the CVEs publicly alongside the fixes, and researchers Nils Langius, B Horn, and Jonathan Bar Or were credited with responsible disclosure, with Oracle, Red Hat, and SUSE contributors helping prepare and upstream the patches.
Several of the vulnerabilities were described as capable of enabling Secure Boot bypass, while CVE-2025-0624 affects network boot and could allow remote code execution from the same network segment. Maintainers said full mitigation requires not only updated GRUB2 but also refreshed shim and other boot artifacts plus updated SBAT revocation data from vendors and Linux distributions; the UEFI dbx revocation list is not being used for this remediation round. The fixes were added upstream to the GRUB2 repository, with major distributions expected to ship updated packages.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
On February 18, 2025, Daniel Kiper announced a 73-patch GRUB2 security bundle addressing numerous vulnerabilities found during a proactive hardening effort. The patches were added upstream to the GRUB2 git repository, and the notice said full mitigation would require updated GRUB2, shim, other boot artifacts, and SBAT revocation data from vendors and distributions.
On February 18, 2025, Oracle's Jan Setje-Eilers disclosed 21 GRUB CVEs via oss-security and stated that fixes were made public at the same time. The issues affected GRUB components including filesystem parsers, gettext, JPEG parsing, networking, GPG hooks, and command handling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** Linux kernel updates for **RHEL 9** under `RHSA-2026:57252`, addressing **26 CVEs** across subsystems including **netfilter, DRM/AMD GPU drivers, SMB client, iSCSI target, memfd, UDF, SMC, and POSIX CPU timers**. The advisory highlights memory-safety issues such as buffer overflows, out-of-bounds reads and writes, use-after-free, double-free, and validation flaws, and requires affected systems to be **rebooted after patching**. Downstream distributions and vendors including **Oracle Linux, Rocky Linux, AlmaLinux, and Unity Linux** published corresponding kernel notices and scanner coverage, with several notices indicating **local exploitation** risk and, in some cases, that **exploits are available**. Two AMD-related kernel flaws illustrate the update set: **`CVE-2026-45878`** in `drm/amdkfd` fixed inconsistent signed/unsigned handling of a userspace-supplied `watch_id`, which could trigger invalid bit shifts, out-of-bounds access to the `watch_points` array, and a buffer overflow; and **`CVE-2026-53329`** in `drm/amd/display` replaced `krealloc()` with `krealloc_array()` to prevent integer-overflow-driven undersized allocations that could lead to heap overflows during vector growth. The weaknesses align with well-known classes such as **`CWE-131`** (incorrect calculation of buffer size), **`CWE-120`** (classic buffer overflow), and in some bundled advisories **`CWE-279`** (incorrect execution-assigned permissions), underscoring the need to prioritize kernel package updates across supported enterprise Linux fleets.
Aug 28, 2026
Linux distributors released security updates to fix multiple **Linux kernel** vulnerabilities that could let attackers bypass security restrictions, trigger denial-of-service conditions, obtain sensitive information, escalate privileges, execute arbitrary code, and gain access to affected systems. The advisory specifically highlighted `CVE-2025-10263`, a local race condition in Translation Lookaside Buffer invalidation operations rated **CVSS 8.4**, and `CVE-2026-46316`, a local **guest-to-host escape** vulnerability rated **CVSS 7.0**. The notice said a proof-of-concept exploit for `CVE-2026-46316` has been disclosed and is circulating in the wild, increasing the urgency for remediation. **Red Hat** and **Ubuntu** were identified as distributors providing fixes, and organizations were urged to validate and deploy patches promptly and monitor their vendors for any additional kernel-related updates.
Jul 8, 2026
Binarly disclosed six critical vulnerabilities in **U-Boot**'s FIT signature verification logic that can be triggered by a malicious FIT image *before* signature checks complete, breaking the intended Verified Boot trust model. The flaws affect code paths present since `U-Boot v2013.07`, potentially spanning more than 50 stable releases and numerous vendor forks used in embedded devices, routers, IoT products, and server **BMCs**; two of the issues may allow arbitrary code execution during boot, while the others can cause denial of service. Researchers warned that exploitation may not require physical access if devices accept firmware through insecure remote update paths such as exposed BMC interfaces, raising the risk of device bricking or persistent firmware implants below the operating system. U-Boot maintainers handled the issues through coordinated disclosure and merged fixes into the mainline repository, and downstream users were urged to update or backport patches because the long-lived, widely reused bootloader code creates broad supply-chain exposure.
Jul 13, 2026