Skip to content
OpenAdvisories
Critical RLSA-2026:96240 1 CVE

Critical: edk2 security update

Published Nov 10, 2026 · Updated Nov 10, 2026

Ecosystem: Rocky Linux

Summary

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.

Security Fix(es):

* edk2: Pre-boot RCE in EDK II PXE driver (CVE-2026-97631)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 10 edk2 0:20251114-5.el10_2.3

Vulnerabilities 1

  • Critical 9.5
    CVE-2026-97631 Public exploit

    Pre-boot RCE in EDK II PXE driver

    EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It co…

    TianoCore EDK2 edk2 qemu Debian Ubuntu Azure Linux

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2559129
  • advisory
    https://access.redhat.com/errata/RHSA-2026:96240