CVE-2026-25828

MEDIUM

grub-btrfs <2026-01-31 - Command Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-25828. PoCs published by XiaomingX, cardosource.

AI-analyzed exploit summary The repository contains a functional PoC for CVE-2026-25828, demonstrating a command injection vulnerability in grub-btrfs's initramfs hook. The exploit leverages unsanitized input from the kernel command line to execute arbitrary commands as root during boot.

Description

grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS command injection because it does not sanitize the $root parameter to resolve_device(). NOTE: a third party reports "exploitation may not be feasible under normal conditions and may depend on specific implementation details within resolve_device."

Exploits (2)

github WORKING POC 10 stars
by XiaomingX · pythonpoc
https://github.com/XiaomingX/data-cve-poc-py-v1/tree/main/2026/CVE-2026-25828

The repository contains a functional PoC for CVE-2026-25828, demonstrating a command injection vulnerability in grub-btrfs's initramfs hook. The exploit leverages unsanitized input from the kernel command line to execute arbitrary commands as root during boot.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: grub-btrfs (all versions up to 2026-01-31)
No auth needed
Prerequisites: physical access to GRUB menu or control over PXE/DHCP/TFTP server
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 2 stars
by cardosource · poc
https://github.com/cardosource/CVE-2026-25828

This repository contains a working PoC for CVE-2026-25828, a command injection vulnerability in the grub-btrfs package for Arch Linux. The exploit leverages unsanitized input in the $root kernel parameter to execute arbitrary commands as root during the boot process.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: grub-btrfs (all versions up to 2026-01-31)
No auth needed
Prerequisites: Physical access to the machine or ability to modify GRUB configuration · Target system using grub-btrfs package
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v3 5.4
EPSS 0.0121
EPSS Percentile 64.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-78
Status published
Published Feb 12, 2026
Tracked Since Feb 18, 2026