This vulnerability in GNU grub2 arises from a programming error where the gettext command remains registered in memory after its module is unloaded, resulting in a use-after-free condition (CWE-416). An attacker invoking the orphaned command can cause the application to access invalid memory, leading to a denial of service via grub crash. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local attack complexity with low privileges and no user interaction, with high impact on confidentiality, integrity, and availability. Red Hat advisories confirm the issue and provide updated grub2 packages for Red Hat Enterprise Linux 8 and OpenShift Container Platform 4.16 to remediate the vulnerability.

Exploitation of this vulnerability can cause grub to crash, resulting in denial of service. The CVSS score indicates potential compromise of confidentiality, integrity, and availability, though the primary confirmed impact is denial of service. There are no known exploits in the wild at this time. The vulnerability affects grub2 versions prior to the patched releases provided by Red Hat.

Official patches are available from Red Hat for affected products including Red Hat Enterprise Linux 8 and OpenShift Container Platform 4.16. Users should apply these updates promptly using the recommended upgrade procedures documented by Red Hat. No additional mitigation actions are indicated beyond applying the official fixes. The vendor advisories should be consulted for detailed upgrade instructions and to verify patch availability for specific environments.