ELSA-2026-18320

ELSA-2026-18320 - edk2 security update

Type:	SECURITY
Impact:	MODERATE
Release Date:	2026-07-21

Description

[20251114-5.0.1.el10_2.2]
- Replace upstream references [Orabug:36569119]

[20251114-5.el10_2.2]
- edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch [RHEL-182421]
- edk2-Bumped-to-OpenSSL-3.5.5-3.patch [RHEL-165699]
- Resolves: RHEL-182421
(edk2/x64: re-enable legacy kernel loader [rhel-10.2.z])
- Resolves: RHEL-165699
(CVE-2026-28390 edk2: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [rhel-10.2])

[20251114-5.el10_2.1]
- edk2-Bumped-to-OpenSSL-3.5.5-2.patch [RHEL-161573]
- Resolves: RHEL-161573
(CVE-2026-31790 edk2: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key [rhel-10.2])

Related CVEs

CVE-2025-9230

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	edk2-20251114-5.0.1.el10_2.2.src.rpm	413caa1e29ddd98b4eae723c527ed5af63afc368a6f0f485847fe745a1128900	-	ol10_aarch64_appstream
	edk2-20251114-5.0.1.el10_2.2.src.rpm	413caa1e29ddd98b4eae723c527ed5af63afc368a6f0f485847fe745a1128900	-	ol10_aarch64_codeready_builder
	edk2-aarch64-20251114-5.0.1.el10_2.2.noarch.rpm	9b02d2c306bfd81003baaadcea73b5bcc451caa5d781e8a1aa0e91402f378707	-	ol10_aarch64_appstream
	edk2-ovmf-20251114-5.0.1.el10_2.2.noarch.rpm	f080a88d946136dc9bfada044d565914778a1989fe18afc13d32a020723f13f6	-	ol10_aarch64_codeready_builder
	edk2-tools-20251114-5.0.1.el10_2.2.aarch64.rpm	9a8534d2810df40d96459314d73231ac23a173a62bf8db8df1c466c026c8433c	-	ol10_aarch64_codeready_builder
	edk2-tools-doc-20251114-5.0.1.el10_2.2.noarch.rpm	4ccc034faa887b7236eba886c6cb7a751f06f1602f6a369cee00af0ae3eef5d9	-	ol10_aarch64_codeready_builder
Oracle Linux 10 (x86_64)	edk2-20251114-5.0.1.el10_2.2.src.rpm	413caa1e29ddd98b4eae723c527ed5af63afc368a6f0f485847fe745a1128900	-	ol10_x86_64_appstream
	edk2-20251114-5.0.1.el10_2.2.src.rpm	413caa1e29ddd98b4eae723c527ed5af63afc368a6f0f485847fe745a1128900	-	ol10_x86_64_codeready_builder
	edk2-aarch64-20251114-5.0.1.el10_2.2.noarch.rpm	9b02d2c306bfd81003baaadcea73b5bcc451caa5d781e8a1aa0e91402f378707	-	ol10_x86_64_codeready_builder
	edk2-ovmf-20251114-5.0.1.el10_2.2.noarch.rpm	f080a88d946136dc9bfada044d565914778a1989fe18afc13d32a020723f13f6	-	ol10_x86_64_appstream
	edk2-tools-20251114-5.0.1.el10_2.2.x86_64.rpm	c3435cf60ac0145c6003fc729aa647bc0502fea1fc71118bec2481e319152eee	-	ol10_x86_64_codeready_builder
	edk2-tools-doc-20251114-5.0.1.el10_2.2.noarch.rpm	4ccc034faa887b7236eba886c6cb7a751f06f1602f6a369cee00af0ae3eef5d9	-	ol10_x86_64_codeready_builder

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team