RHSA-2026:96240: Critical: edk2 security update

Q: What component is affected by this issue?

The issue affects the EDK II PXE driver in the edk2 UEFI firmware package used to provide UEFI support for QEMU and KVM virtual machines.

Q: What level of access or condition does an attacker need?

The provided information identifies the issue as pre-boot remote code execution in the PXE driver, but does not specify the precise network position, authentication requirements, or packet-handling conditions needed for exploitation.

Q: Which platforms are included in this advisory?

The listed software includes Red Hat Enterprise Linux and CodeReady Linux Builder channels for ARM 64 and x86_64, including specified Extended Update Support channels. The advisory also lists edk2-tools, edk2-tools-debuginfo, and edk2-debugsource.

Published Nov 9, 2026

Updated

Critical: edk2 security update

Other sources

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): edk2: Pre-boot RCE in EDK II PXE driver (CVE-2026-97631) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

— Red Hat

Affected Software

26 affected componentsFixes available

Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Update Support

Red Hat Red Hat CodeReady Linux Builder for ARM 64

Red Hat Red Hat Enterprise Linux for x86_64 - 4 years of updates

Red Hat Red Hat CodeReady Linux Builder for x86_64

Red Hat Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support

Red Hat Red Hat CodeReady Linux Builder for Power, little endian

Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for x86_64 - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for ARM 64 - 4 years of updates

Red Hat Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support

Red Hat Red Hat Enterprise Linux for x86_64

Red Hat Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support

Red Hat Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support

Red Hat Red Hat Enterprise Linux for x86_64 - Extended Update Support

Red Hat Red Hat CodeReady Linux Builder for IBM z Systems

Red Hat Red Hat Enterprise Linux for ARM 64

redhat/edk2<20251114-5.el10_2.3

20251114-5.el10_2.3

redhat/edk2-ovmf<20251114-5.el10_2.3

20251114-5.el10_2.3

redhat/edk2-aarch64<20251114-5.el10_2.3

20251114-5.el10_2.3

redhat/edk2-debugsource<20251114-5.el10_2.3

20251114-5.el10_2.3

redhat/edk2-tools<20251114-5.el10_2.3

20251114-5.el10_2.3

redhat/edk2-tools-debuginfo<20251114-5.el10_2.3

20251114-5.el10_2.3

redhat/edk2-tools-doc<20251114-5.el10_2.3

20251114-5.el10_2.3

redhat/edk2-debugsource<20251114-5.el10_2.3.aa

20251114-5.el10_2.3.aa

redhat/edk2-tools<20251114-5.el10_2.3.aa

20251114-5.el10_2.3.aa

redhat/edk2-tools-debuginfo<20251114-5.el10_2.3.aa

20251114-5.el10_2.3.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/edk2 to a version that resolves this vulnerability.
Fixed in 20251114-5.el10_2.3
Upgrade
Upgrade redhat/edk2-ovmf to a version that resolves this vulnerability.
Fixed in 20251114-5.el10_2.3
Upgrade
Upgrade redhat/edk2-aarch64 to a version that resolves this vulnerability.
Fixed in 20251114-5.el10_2.3
Upgrade
Upgrade redhat/edk2-debugsource to a version that resolves this vulnerability.
Fixed in 20251114-5.el10_2.3
Upgrade
Upgrade redhat/edk2-tools to a version that resolves this vulnerability.
Fixed in 20251114-5.el10_2.3
Upgrade
Upgrade redhat/edk2-tools-debuginfo to a version that resolves this vulnerability.
Fixed in 20251114-5.el10_2.3
Upgrade
Upgrade redhat/edk2-tools-doc to a version that resolves this vulnerability.
Fixed in 20251114-5.el10_2.3
Upgrade
Upgrade redhat/edk2-debugsource to a version that resolves this vulnerability.
Fixed in 20251114-5.el10_2.3.aa
Upgrade
Upgrade redhat/edk2-tools to a version that resolves this vulnerability.
Fixed in 20251114-5.el10_2.3.aa
Upgrade
Upgrade redhat/edk2-tools-debuginfo to a version that resolves this vulnerability.
Fixed in 20251114-5.el10_2.3.aa

Event History

Nov 9, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Advisory Published

via Red Hat·11:21 AM

Data Sourced

via Red Hat·11:21 AM

Severity

Frequently Asked Questions

What component is affected by this issue?

The issue affects the EDK II PXE driver in the edk2 UEFI firmware package used to provide UEFI support for QEMU and KVM virtual machines.

What level of access or condition does an attacker need?

The provided information identifies the issue as pre-boot remote code execution in the PXE driver, but does not specify the precise network position, authentication requirements, or packet-handling conditions needed for exploitation.

Which platforms are included in this advisory?

The listed software includes Red Hat Enterprise Linux and CodeReady Linux Builder channels for ARM 64 and x86_64, including specified Extended Update Support channels. The advisory also lists edk2-tools, edk2-tools-debuginfo, and edk2-debugsource.

RHSA-2026:96240: Critical: edk2 security update

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What component is affected by this issue?

What level of access or condition does an attacker need?

Which platforms are included in this advisory?

Company

Resources

Contact

Frequently Asked Questions

What component is affected by this issue?

What level of access or condition does an attacker need?

Which platforms are included in this advisory?