Antynea/grub-btrfs

Releases60

Frequency2 months 3 days

Last Release 9 months ago

Stars1.12K

Include btrfs snapshots at boot options. (Grub menu)

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2026-25828 ↗	Feb 12, 2026Thursday, 12 February 2026, 22:16	5.4 MEDIUM	—
grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS command injection because it does not sanitize the $root parameter to resolve_device(). NOTE: a third party reports "exploitation may not be feasible under normal conditions and may depend on specific implementation details within resolve_device."