The GRUB2 bootloader contains a use-after-free vulnerability in its normal command implementation. When the module containing this command is unloaded, the command is not properly unregistered, resulting in a dangling pointer. An attacker able to execute the normal command can cause the system to access invalid memory locations, leading to system crashes and denial of service. The vulnerability affects version 0 of grub2 as reported. The CVSS 3.1 vector indicates local attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. No known exploits are reported in the wild. The Red Hat advisory is available but does not explicitly state patch availability or remediation details.

Successful exploitation causes system instability and denial of service by crashing the system. There is also a potential, though not confirmed, impact on data confidentiality and integrity. The attack requires local access and has high complexity, limiting ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2025-61663 for current remediation guidance. Until a patch or official fix is available, restrict local access to trusted users only to reduce risk. Monitor vendor communications for updates on fixes or workarounds.