RLSA-2026:97212: Low: edk2 security, bug fix, and enhancement update
EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.
Security Fix(es):
openssl: Use After Free with SSLfreebuffers (CVE-2024-4741)
Bug Fix(es) and Enhancement(s):
[edk2,rhel-10] rebase to edk2-stable202602 (JIRA:Rocky Linux-151719)
edk2/x64: re-enable legacy kernel loader (JIRA:Rocky Linux-182419)
[edk2,rhel-10] Unable to allocate PCI BAR with edk2-20260221-1.el10 (JIRA:Rocky Linux-188305)
[edk2] update dbx database to release 1.6.5 (JIRA:Rocky Linux-193127)
[Rocky Linux 10.3] TDX Secure Boot Setup Mode with OVMF.inteltdx.secboot.fd (JIRA:Rocky Linux-220548)
add shell.efi to aarch64 sub-rpm (JIRA:Rocky Linux-235957)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/edk2-aarch64to a version that resolves this vulnerability.Fixed in 0:20260221-7.el10 - Upgrade
Upgrade
rocky-linux/edk2-tools-docto a version that resolves this vulnerability.Fixed in 0:20260221-7.el10 - Upgrade
Upgrade
rocky-linux/edk2-ovmfto a version that resolves this vulnerability.Fixed in 0:20260221-7.el10 - Upgrade
Upgrade
rocky-linux/edk2-debugsourceto a version that resolves this vulnerability.Fixed in 0:20260221-7.el10 - Upgrade
Upgrade
rocky-linux/edk2-tools-debuginfoto a version that resolves this vulnerability.Fixed in 0:20260221-7.el10 - Upgrade
Upgrade
rocky-linux/edk2-toolsto a version that resolves this vulnerability.Fixed in 0:20260221-7.el10
Event History
Frequently Asked Questions
What access does an attacker need to exploit the issue?
The CVSS vector indicates network reachability, no privileges, and no user interaction are required. Exploitation has high attack complexity.
Which installed components should be assessed?
The advisory lists rocky-linux/edk2-aarch64, rocky-linux/edk2-tools-doc, rocky-linux/edk2-ovmf, rocky-linux/edk2-debugsource, rocky-linux/edk2-tools-debuginfo, and rocky-linux/edk2-tools. The EDK package provides sample 64-bit UEFI firmware for QEMU and KVM.
What impact is indicated if exploitation succeeds?
The CVSS vector rates confidentiality, integrity, and availability impact as low. The issue is classified as a use-after-free vulnerability.