RLSA-2026:39297

Security

Mirrored from RHSA-2026:39297

Issued at: 2026-07-15

Updated at: 2026-07-16

Synopsis

Moderate: edk2 security, bug fix, and enhancement update

Description

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.

Security Fix(es):

* openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790)

* openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)

Bug Fix(es) and Enhancement(s):

* edk2/x64: re-enable legacy kernel loader [rhel-10.2.z] (JIRA:Rocky Linux-182421)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected products

Rocky Linux 10 aarch64

Rocky Linux 10 ppc64le

Rocky Linux 10 riscv64

Rocky Linux 10 s390x

Rocky Linux 10 x86_64

Fixes

2456314

2451094

CVEs

CVE-2026-28390

CVE-2026-31790

Affected packages

Rocky Linux 10 aarch64 - CRB

edk2-debugsource-0:20251114-5.el10_2.2.aarch64.rpm

edk2-tools-0:20251114-5.el10_2.2.aarch64.rpm

edk2-tools-debuginfo-0:20251114-5.el10_2.2.aarch64.rpm

edk2-ovmf-0:20251114-5.el10_2.2.noarch.rpm

edk2-tools-doc-0:20251114-5.el10_2.2.noarch.rpm