Hey folks,

We have some security fixes for grub2 that I'd like to get into the
next trixie point release please. There are a bunch of CVE fixes
backported from upstream, plus a matching bump in SBAT level from
grub,5 to grub,7 that will be needed. The last change in particular is
needed to fix a known Secure Boot bypass bug.

Changelog:

grub2 (2.12-9+deb13u3) trixie; urgency=medium

  [ Fabian Grünbichler ]
  * Patches for November 2025 CVEs
    + CVE-2025-54770: a use-after-free issue in the network module's
      VLAN handling code that can be used to trigger a denial of
      service
    + CVE-2025-54771: a use-after-free issue when closing a file which
      can be used to trigger at least a denial of service
    + CVE-2025-61661: mishandling of string conversion when reading data from a
      (malicious) USB device, which can be used to trigger at least a denial of
      service
    + CVE-2025-61662: a use-after-free issue in the gettext module,
      which can be used to trigger at least a denial of service
    + CVE-2025-61663/CVE-2025-61664: two use-after-free issues when
      unloading the `normal` module, which can be used to trigger at
      least a denial of service
    + Bump SBAT to grub,6 to match.
  * Patches for September 2026 CVE
    + CVE-2026-97876: serial MMIO secure boot bypass
    + Bump SBAT to grub,7 to match.

And jmw pointed me at the previous pu bug #1140751 for a riscv64
fix. I've merged those changes on top of the changes I posted
yesterday to make grub2/2.12-9+deb13u4

Uploaded just now, here's the extra debdiff between u3 and u4..