Skip to content
OpenAdvisories
Critical ELSA-2026-96240 1 CVE

Critical: edk2 security update (Oracle Linux 10)

Published Nov 9, 2026 · Updated Nov 9, 2026

Ecosystem: Oracle Linux

Summary

[20251114-5.0.1.el10_2.3]
- Replace upstream references [Orabug:36569119]

[20251114-5.el10_2.3]
- edk2-NetworkPkg-UefiPxeBcDxe-Fix-ICMP-buffer-overflow-in-.patch [RHEL-291254]
- Resolves: RHEL-291254
(CVE-2026-97631 edk2: Pre-boot RCE in EDK II PXE driver [rhel-10.2.z])

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 10 edk2-aarch64 0:20251114-5.0.1.el10_2.3
Oracle Linux · 10 edk2-ovmf 0:20251114-5.0.1.el10_2.3
Oracle Linux · 10 edk2-tools 0:20251114-5.0.1.el10_2.3
Oracle Linux · 10 edk2-tools-doc 0:20251114-5.0.1.el10_2.3

Vulnerabilities 1

  • Critical 9.5
    CVE-2026-97631 Public exploit

    Pre-boot RCE in EDK II PXE driver

    EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It co…

    TianoCore EDK2 edk2 qemu Debian Ubuntu Azure Linux