GRUB2 (commands/extcmd): A failed allocation goes unchecked, so GRUB proceeds on a NULL pointer and its state

Impact

A failed allocation goes unchecked, so GRUB proceeds on a NULL pointer and its state becomes attacker-influenced. Practical outcome is the same as the rest of this batch: a foothold below the OS that reimaging does not remove.

Who can reach it

Local, through GRUB command processing on a node the attacker can already influence.

What to do

grub2 package update + reboot. This whole 2025 batch lands as one distro update - do it as a single pass rather than 20 separate changes, and remember to rebuild the netboot image.

References