ALSA-2026:96240: Critical: edk2 security update

Q: Which deployments should be prioritized for review?

Prioritize QEMU and KVM virtual machine environments using the supplied 64-bit UEFI firmware, especially where the EDK II PXE driver is present. The advisory lists almalinux/edk2-ovmf and almalinux/edk2-aarch64, along with edk2-tools and edk2-tools-doc.

Q: How can I determine whether a system is covered by this advisory?

Check whether any of the listed AlmaLinux edk2 packages are installed: edk2-aarch64, edk2-ovmf, edk2-tools, or edk2-tools-doc. The provided data does not include affected or fixed package versions, so installation alone cannot establish patch status.

Published Nov 9, 2026

Updated

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.

Security Fix(es):

edk2: Pre-boot RCE in EDK II PXE driver (CVE-2026-97631)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

4 affected componentsFixes available

almalinux/edk2-aarch64<20251114-5.el10_2.3.alma.1

20251114-5.el10_2.3.alma.1

almalinux/edk2-ovmf<20251114-5.el10_2.3.alma.1

20251114-5.el10_2.3.alma.1

almalinux/edk2-tools<20251114-5.el10_2.3.alma.1

20251114-5.el10_2.3.alma.1

almalinux/edk2-tools-doc<20251114-5.el10_2.3.alma.1

20251114-5.el10_2.3.alma.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade almalinux/edk2-aarch64 to a version that resolves this vulnerability.
Fixed in 20251114-5.el10_2.3.alma.1
Upgrade
Upgrade almalinux/edk2-ovmf to a version that resolves this vulnerability.
Fixed in 20251114-5.el10_2.3.alma.1
Upgrade
Upgrade almalinux/edk2-tools to a version that resolves this vulnerability.
Fixed in 20251114-5.el10_2.3.alma.1
Upgrade
Upgrade almalinux/edk2-tools-doc to a version that resolves this vulnerability.
Fixed in 20251114-5.el10_2.3.alma.1

Event History

Nov 9, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-97631

Frequently Asked Questions

Which deployments should be prioritized for review?

Prioritize QEMU and KVM virtual machine environments using the supplied 64-bit UEFI firmware, especially where the EDK II PXE driver is present. The advisory lists almalinux/edk2-ovmf and almalinux/edk2-aarch64, along with edk2-tools and edk2-tools-doc.

How can I determine whether a system is covered by this advisory?

Check whether any of the listed AlmaLinux edk2 packages are installed: edk2-aarch64, edk2-ovmf, edk2-tools, or edk2-tools-doc. The provided data does not include affected or fixed package versions, so installation alone cannot establish patch status.

ALSA-2026:96240: Critical: edk2 security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be prioritized for review?

How can I determine whether a system is covered by this advisory?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for review?

How can I determine whether a system is covered by this advisory?