This vulnerability in GRUB2's network module involves a Use-after-Free condition triggered by the net_set_vlan command not being properly unregistered upon module unload. An attacker able to execute this command can cause the system to access invalid memory, resulting in a denial of service through system crash. The CVSS 3.1 base score is 4.9 (medium severity) with attack vector local, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability rated as low to low to low respectively. The affected product is GNU grub2. No explicit patch or remediation details are provided in the vendor advisory content, which primarily contains navigation and site information without technical remediation guidance.

Successful exploitation leads to system instability and a complete crash, causing denial of service. The impact affects system availability primarily, with minor impacts on confidentiality and integrity as per the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2025-54770 for current remediation guidance. No official fix or workaround is explicitly stated in the provided advisory content. Until a patch is available, limit local access to trusted users to reduce risk, as the attack vector is local with high complexity.