Bug#1153149: trixie-pu: package grub2/2.12-9+deb13u3

[Steve McIntyre]

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: grub2 at packages.debian.org
Control: affects -1 + src:grub2
User: release.debian.org at packages.debian.org
Usertags: pu

Hey folks,

We have some security fixes for grub2 that I'd like to get into the
next trixie point release please. There are a bunch of CVE fixes
backported from upstream, plus a matching bump in SBAT level from
grub,5 to grub,7 that will be needed. The last change in particular is
needed to fix a known Secure Boot bypass bug.

Changelog:

grub2 (2.12-9+deb13u3) trixie; urgency=medium

  [ Fabian Grünbichler ]
  * Patches for November 2025 CVEs
    + CVE-2025-54770: a use-after-free issue in the network module's
      VLAN handling code that can be used to trigger a denial of
      service
    + CVE-2025-54771: a use-after-free issue when closing a file which
      can be used to trigger at least a denial of service
    + CVE-2025-61661: mishandling of string conversion when reading data from a
      (malicious) USB device, which can be used to trigger at least a denial of
      service
    + CVE-2025-61662: a use-after-free issue in the gettext module,
      which can be used to trigger at least a denial of service
    + CVE-2025-61663/CVE-2025-61664: two use-after-free issues when
      unloading the `normal` module, which can be used to trigger at
      least a denial of service
    + Bump SBAT to grub,6 to match.
  * Patches for September 2026 CVE
    + CVE-2026-97876: serial MMIO secure boot bypass
    + Bump SBAT to grub,7 to match.

 -- Steve McIntyre <93sam at debian.org>  Thu, 05 Nov 2026 12:17:08 +0000

Full debdiff is attached.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: grub2_2.12-9+deb13u3.debdiff.gz
Type: application/gzip
Size: 9085 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-grub-devel/attachments/20261106/b63f8245/attachment.gz>