diff --git a/bugfix-fix-not-verifying-grub-cfg-when-loading-it.patch b/bugfix-fix-not-verifying-grub-cfg-when-loading-it.patch
new file mode 100644
index 0000000000000000000000000000000000000000..269b471ce8044a5d8dbab14900b7d4a9334dcde9
--- /dev/null
+++ b/bugfix-fix-not-verifying-grub-cfg-when-loading-it.patch
@@ -0,0 +1,36 @@
+From 7d26233eb454d75419476eb9d1729ea3b2972238 Mon Sep 17 00:00:00 2001
+From: Qiumiao Zhang <zhangqiumiao1@huawei.com>
+Date: Wed, 18 Dec 2024 09:26:33 +0000
+Subject: [PATCH] fix not verifying grub.cfg when loading it
+
+Fixes: c8b6446348a4 ("skip verification when not loading grub.cfg")
+Signed-off-by: Qiumiao Zhang <zhangqiumiao1@huawei.com>
+---
+ grub-core/normal/main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
+index f3e14bf..06d91c0 100644
+--- a/grub-core/normal/main.c
++++ b/grub-core/normal/main.c
+@@ -134,7 +134,7 @@ read_config_file (const char *config)
+     }
+ 
+   /* Try to open the config file.  */
+-  rawfile = grub_file_open (config, GRUB_FILE_TYPE_SKIP_SIGNATURE);
++  rawfile = grub_file_open (config, GRUB_FILE_TYPE_CONFIG);
+   if (! rawfile)
+     return 0;
+ 
+@@ -373,7 +373,7 @@ grub_try_normal (const char *variable)
+        if (config)
+          {
+            grub_file_t file;
+-           file = grub_file_open (config, GRUB_FILE_TYPE_CONFIG);
++           file = grub_file_open (config, GRUB_FILE_TYPE_SKIP_SIGNATURE);
+            if (file)
+              {
+                grub_file_close (file);
+-- 
+2.33.0
+
diff --git a/grub.patches b/grub.patches
index 0aa9a69ad3fcaef8070a98eb44e5734713d72d28..14f82b47c92952b8618cdc872125919fafa785eb 100644
--- a/grub.patches
+++ b/grub.patches
@@ -245,3 +245,4 @@ Patch245:       0002-efi-Add-API-for-retrieving-the-EFI-secret-for-crypto.patch
 Patch246:       backport-acpi-Fix-out-of-bounds-access-in-grub_acpi_xsdt_find.patch
 Patch247:       backport-commands-efi-tpm-Re-enable-measurements-on-confident.patch
 Patch248:       backport-commands-legacycfg-Avoid-closing-file-twice.patch
+Patch249:       bugfix-fix-not-verifying-grub-cfg-when-loading-it.patch
diff --git a/grub2.spec b/grub2.spec
index 231bc161bc60a5f48b52538b2e7589ce78312327..1ba12aa0213d7f7e414be977941b55f84b11d3f0 100644
--- a/grub2.spec
+++ b/grub2.spec
@@ -19,7 +19,7 @@
 Name:		grub2
 Epoch:		1
 Version:	2.12
-Release:	30
+Release:	31
 Summary:	Bootloader with support for Linux, Multiboot and more
 License:	GPLv3+
 URL:		http://www.gnu.org/software/grub/
@@ -461,6 +461,12 @@ fi
 %{_datadir}/man/man*
 
 %changelog
+* Mon Dec 23 2024 zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.12-31
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:fix not verifying grub.cfg when loading it
+
 * Sat Dec 21 2024 zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.12-30
 - Type:bugfix
 - CVE:NA