Fix CVE-2025-61662

Missing unregister call for gettext command may lead to use-after-free
Resolves: RHEL-141583

0683-gettext-gettext-Unregister-gettext-command-on-module.patch

@@ -0,0 +1,62 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Alec Brown <alec.r.brown@oracle.com>
+Date: Thu, 21 Aug 2025 21:14:06 +0000
+Subject: [PATCH] gettext/gettext: Unregister gettext command on module unload
+
+When the gettext module is loaded, the gettext command is registered but
+isn't unregistered when the module is unloaded. We need to add a call to
+grub_unregister_command() when unloading the module.
+
+Fixes: CVE-2025-61662
+
+Reported-by: Alec Brown <alec.r.brown@oracle.com>
+Signed-off-by: Alec Brown <alec.r.brown@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+---
+ grub-core/gettext/gettext.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
+index 0e51b5d28ad0..92e91b35e87f 100644
+--- a/grub-core/gettext/gettext.c
++++ b/grub-core/gettext/gettext.c
+@@ -509,6 +509,8 @@ grub_cmd_translate (grub_command_t cmd __attribute__ ((unused)),
+   return 0;
+ }
+ 
++static grub_command_t cmd;
++
+ GRUB_MOD_INIT (gettext)
+ {
+   const char *lang;
+@@ -528,13 +530,14 @@ GRUB_MOD_INIT (gettext)
+   grub_register_variable_hook ("locale_dir", NULL, read_main);
+   grub_register_variable_hook ("secondary_locale_dir", NULL, read_secondary);
+ 
+-  grub_register_command_p1 ("gettext", grub_cmd_translate,
+-			    N_("STRING"),
+-			    /* TRANSLATORS: It refers to passing the string through gettext.
+-			       So it's "translate" in the same meaning as in what you're 
+-			       doing now.
+-			     */
+-			    N_("Translates the string with the current settings."));
++  cmd = grub_register_command_p1 ("gettext", grub_cmd_translate,
++				  N_("STRING"),
++				  /*
++				   * TRANSLATORS: It refers to passing the string through gettext.
++				   * So it's "translate" in the same meaning as in what you're
++				   * doing now.
++				   */
++				  N_("Translates the string with the current settings."));
+ 
+   /* Reload .mo file information if lang changes.  */
+   grub_register_variable_hook ("lang", NULL, grub_gettext_env_write_lang);
+@@ -551,6 +554,8 @@ GRUB_MOD_FINI (gettext)
+   grub_register_variable_hook ("secondary_locale_dir", NULL, NULL);
+   grub_register_variable_hook ("lang", NULL, NULL);
+ 
++  grub_unregister_command (cmd);
++
+   grub_gettext_delete_list (&main_context);
+   grub_gettext_delete_list (&secondary_context);
+ 

grub.patches

@@ -679,3 +679,4 @@ Patch0679: 0679-disk-Rename-grub_disk_get_size-to-grub_disk_native_s.patch
 Patch0680: 0680-fs-Fix-block-lists-not-being-able-to-address-to-end-.patch
 Patch0681: 0681-osdep-linux-hostdisk-Modify-sector-by-sysfs-as-disk-.patch
 Patch0682: 0682-cryptodisk-Fix-incorrect-calculation-of-start-sector.patch
+Patch0683: 0683-gettext-gettext-Unregister-gettext-command-on-module.patch

grub2.spec

@@ -7,7 +7,7 @@
 Name:		grub2
 Epoch:		1
 Version:	2.02
-Release:	170%{?dist}
+Release:	170%{?dist}.1
 Summary:	Bootloader with support for Linux, Multiboot and more
 Group:		System Environment/Base
 License:	GPLv3+
@@ -526,6 +526,10 @@ fi
 %endif
 
 %changelog
+* Thu Feb 19 2026 Therese Cornell <tcornell@redhat.com> - 2.02-170.1
+- Fixes CVE-2025-61662 Missing unregister call for gettext command may lead to use-after-free
+- Resolves: #RHEL-141583
+
 * Thu Jan 22 2026 Nicolas Frayer <nfrayer@redhat.com> - 2.02-170
 - fs/xfs/ppc64le: Update xfs code to fix install on 4KB block size
 - Resolves: #RHEL-142208