CVE-2026-25828

grub-btrfs through 2026-01-31 on Arch Linux and derivative distributions allows initramfs OS command injection because it does not sanitize the $root parameter to resolvedevice. NOTE: a third party reports "exploitation may not be feasible under normal conditions and may depend on specific...

CVE-2026-25828

grub-btrfs through 2026-01-31 on Arch Linux and derivative distributions allows initramfs OS command injection because it does not sanitize the $root parameter to resolvedevice. NOTE: a third party reports "exploitation may not be feasible under normal conditions and may depend on specific...

CVE-2026-25828

The grub-btrfs tool (versions up to 2026-01-31 ) used on Arch Linux and derivative distributions is vulnerable to an initramfs OS command injection . The root cause is a lack of sanitization for the $root parameter when passed to the resolve_device() function within the grub-btrfs-overlayfs initr...