A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied to it and can bypass the secure boot validations, allowing the attacker to load another non-trusted code.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://bugzilla.redhat.com/show_bug.cgi?id=2089529 Issue Tracking, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2089529 Issue Tracking, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.2 · redhatNVD modified 2026-10-08 21:17
Affected (CPE criteria) 1
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
References 2
- https://bugzilla.redhat.com/show_bug.cgi?id=2089529 Issue Tracking, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2089529 Issue Tracking, Vendor Advisory