Skip to content
OpenAdvisories
Critical ALSA-2026:96240 1 CVE

Critical: edk2 security update

Published Nov 9, 2026 · Updated Nov 10, 2026

Ecosystem: AlmaLinux

Summary

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.

Security Fix(es):

* edk2: Pre-boot RCE in EDK II PXE driver (CVE-2026-97631)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 4

ReleasePackageFixed in
AlmaLinux · 10 edk2-aarch64 20251114-5.el10_2.3.alma.1
AlmaLinux · 10 edk2-ovmf 20251114-5.el10_2.3.alma.1
AlmaLinux · 10 edk2-tools 20251114-5.el10_2.3.alma.1
AlmaLinux · 10 edk2-tools-doc 20251114-5.el10_2.3.alma.1

Vulnerabilities 1

  • Critical 9.5
    CVE-2026-97631 Public exploit

    Pre-boot RCE in EDK II PXE driver

    EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It co…

    TianoCore EDK2 edk2 qemu Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-97631
  • report
    https://bugzilla.redhat.com/2559129
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-96240.html