From a8e70bc2ea1d42bd4a7b7e1e65e2d26497bc660f Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sat, 8 Nov 2025 16:58:05 +0100
Subject: [PATCH] grub2: apply patch for CVE-2025-4382

(cherry picked from commit 753b67e7d99f792eb6909a8da7d4cb2cf55124fc)
---
 pkgs/tools/misc/grub/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix
index 4e795fd6607e..d81d576aa6c1 100644
--- a/pkgs/tools/misc/grub/default.nix
+++ b/pkgs/tools/misc/grub/default.nix
@@ -495,6 +495,11 @@ stdenv.mkDerivation rec {
       url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=348cd416a3574348f4255bf2b04ec95938990997";
       hash = "sha256-WBLYQxv8si2tvdPAvbm0/4NNqYWBMJpFV4GC0HhN/kE=";
     })
+    (fetchpatch {
+      name = "CVE-2025-4382.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c448f511e74cb7c776b314fcb7943f98d3f22b6d";
+      hash = "sha256-64gMhCEW0aYHt46crX/qN/3Hj8MgvWLazgQlVXqe8LE=";
+    })
   ];
 
   postPatch =