RHSA-2026:39297: Moderate: edk2 security, bug fix, and enhancement update

Published Jul 14, 2026

Updated

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790) openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390) Bug Fix(es) and Enhancement(s): edk2/x64: re-enable legacy kernel loader [rhel-10.2.z] (JIRA:RHEL-182421) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Other sources

Moderate: edk2 security, bug fix, and enhancement update

— Red Hat

Affected Software

1 affected component

Red Hat Red Hat Enterprise Linux for ARM 64

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openssl to a version that resolves this vulnerability.
Patch CVE-2026-31790
Upgrade
Upgrade openssl to a version that resolves this vulnerability.
Patch CVE-2026-28390
Upgrade
Upgrade edk2/x64 to a version that resolves this vulnerability.
Patch JIRA:RHEL-182421

Event History

Jul 14, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Advisory Published

via Red Hat·01:43 PM

Data Sourced

via Red Hat·01:43 PM

Severity

Frequently Asked Questions

What is the severity of RHSA-2026:39297?

The severity of RHSA-2026:39297 is classified as medium with a score of 4.

What vulnerabilities are addressed in RHSA-2026:39297?

RHSA-2026:39297 addresses a security issue related to information disclosure from uninitialized memory via an invalid RSA public key.

How do I fix RHSA-2026:39297?

To fix RHSA-2026:39297, apply the provided updates for the EDK2 package in your Red Hat Enterprise Linux environment.

What is the impact of the vulnerability in RHSA-2026:39297?

The impact of the vulnerability in RHSA-2026:39297 is potential information disclosure, which could allow unauthorized access to sensitive data.

Is RHSA-2026:39297 applicable to all Red Hat systems?

RHSA-2026:39297 is specifically applicable to Red Hat Enterprise Linux for ARM 64.