<oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:red-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
<generator>
<oval:product_name>Oracle Errata System</oval:product_name>
<oval:product_version>Oracle Linux</oval:product_version>
<oval:schema_version>5.11</oval:schema_version>
<oval:timestamp>2026-07-15T10:57:32</oval:timestamp>
</generator>
<definitions>
<definition id="oval:com.oracle.elsa:def:202618465" version="501" class="patch">
<metadata>
<title>
ELSA-2026-18465:  edk2 security update (IMPORTANT)
</title>
<affected family="unix">
<platform>Oracle Linux 10</platform>

</affected>
<reference source="elsa" ref_id="ELSA-2026-18465" ref_url="https://linux.oracle.com/errata/ELSA-2026-18465.html"/>
<reference source="CVE" ref_id="CVE-2025-2296" ref_url="https://linux.oracle.com/cve/CVE-2025-2296.html"/>

<description>
[20251114-5.0.1]
- Replace upstream references [Orabug:36569119]

[20251114-5]
- edk2-add-uefi-vars-firmware-json-files.patch [RHEL-150696]
- Resolves: RHEL-150696
  (edk2: Add JSON descriptors for uefi-vars builds)

[20251114-4]
- edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch [RHEL-134956]
- edk2-update-openssl-rhel-submodule.patch [RHEL-147785]
- edk2-update-openssl-rhel-tarball.patch [RHEL-147785]
- Resolves: RHEL-134956
  (CVE-2025-2296 edk2: EDK2: Improper Input Validation allows arbitrary command execution [rhel-10.2])
- Resolves: RHEL-147785
  ([edk2] pick up openssl updates)

[20251114-3]
- edk2-OvmfPkg-AmdSev-add-memory-debug-log-support.patch [RHEL-139470]
- edk2-OvmfPkg-MemDebugLogPeiLib-drop-duplicate-MemDebugLog.patch [RHEL-139470]
- edk2-OvmfPkg-MemDebugLogPeiCoreLib-enable-for-PEIMs.patch [RHEL-139470]
- edk2-ArmVirtPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470]
- edk2-OvmfPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470]
- Resolves: RHEL-139470
  (Enable memory debug logging support in firmware image configs)

[20251114-2]
- edk2-ArmPkg-UefiCpuPkg-Fix-boot-failure-on-FEAT_LPA-only-.patch [RHEL-138335]
- Resolves: RHEL-138335
  ([AmpereoneX] ArmConfigureMmu: The MaxAddress 0xFFFFFFFFFFFFF is not supported by this MMU configuration)

[20251114-1]
- Rebase to edk2-stable202511 [RHEL-118386]
- Resolves: RHEL-118386
  ([edk2,rhel-10] rebase to edk2-stable202511)

[20250822-4]
- edk2-make-dbxupdate.sh-get-version-tag-add-to-commit-mess.patch [RHEL-126085]
- edk2-update-dbx-to-20251016-v1.6.1.patch [RHEL-126085]
- Resolves: RHEL-126085
  ([edk2,rhel-10] dbx update to 20251016 / v1.6.1)

[20250822-3]
- edk2-Bumped-OpenSSL-to-3.5.1-6.patch [RHEL-115880]
- Resolves: RHEL-115880
  (CVE-2025-9230 edk2: Out-of-bounds read &amp; write in RFC 3211 KEK Unwrap [rhel-10.2])

[20250822-2]
- edk2-add-DBXUpdate-20250610.aa64.bin.patch [RHEL-109548]
- Resolves: RHEL-109548
  ([aarch64][edk2] missing DBXUpdate-.aa64.bin)

[20250822-1]
- Rebase to edk2-stable202508 [RHEL-111718]
- Resolves: RHEL-111718
  ([edk2,rhel-10] rebase to edk2-stable202508)
</description>
<!--
 ~~~~~~~~~~~~~~~~~~~~   advisory details   ~~~~~~~~~~~~~~~~~~~ 
-->
<advisory>
<severity>IMPORTANT</severity>
<rights>Copyright 2026 Oracle, Inc.</rights>
<issued date="2026-07-08"/>
<cve cvss3="8.2/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" href="https://linux.oracle.com/cve/CVE-2025-2296.html" public="20251209">CVE-2025-2296</cve>

<affected_cpe_list>
<cpe>cpe:/a:oracle:linux:10::appstream</cpe>
<cpe>cpe:/a:oracle:linux:10::codeready_builder</cpe>
</affected_cpe_list>
</advisory>
</metadata>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:202618465001" comment="Oracle Linux 10 is installed"/>
<criteria operator="OR">
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:202618465002" comment="Oracle Linux arch is aarch64"/>
<criteria operator="OR">
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:202618465003" comment="edk2-aarch64 is earlier than 0:20251114-5.0.1.el10_2"/>
<criterion test_ref="oval:com.oracle.elsa:tst:202618465004" comment="edk2-aarch64 is signed with the Oracle Linux 10 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:202618465005" comment="edk2-ovmf is earlier than 0:20251114-5.0.1.el10_2"/>
<criterion test_ref="oval:com.oracle.elsa:tst:202618465006" comment="edk2-ovmf is signed with the Oracle Linux 10 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:202618465007" comment="edk2-tools is earlier than 0:20251114-5.0.1.el10_2"/>
<criterion test_ref="oval:com.oracle.elsa:tst:202618465008" comment="edk2-tools is signed with the Oracle Linux 10 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:202618465009" comment="edk2-tools-doc is earlier than 0:20251114-5.0.1.el10_2"/>
<criterion test_ref="oval:com.oracle.elsa:tst:202618465010" comment="edk2-tools-doc is signed with the Oracle Linux 10 key"/>
</criteria>
</criteria>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:202618465011" comment="Oracle Linux arch is x86_64"/>
<criteria operator="OR">
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:202618465005" comment="edk2-ovmf is earlier than 0:20251114-5.0.1.el10_2"/>
<criterion test_ref="oval:com.oracle.elsa:tst:202618465006" comment="edk2-ovmf is signed with the Oracle Linux 10 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:202618465003" comment="edk2-aarch64 is earlier than 0:20251114-5.0.1.el10_2"/>
<criterion test_ref="oval:com.oracle.elsa:tst:202618465004" comment="edk2-aarch64 is signed with the Oracle Linux 10 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:202618465007" comment="edk2-tools is earlier than 0:20251114-5.0.1.el10_2"/>
<criterion test_ref="oval:com.oracle.elsa:tst:202618465008" comment="edk2-tools is signed with the Oracle Linux 10 key"/>
</criteria>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:202618465009" comment="edk2-tools-doc is earlier than 0:20251114-5.0.1.el10_2"/>
<criterion test_ref="oval:com.oracle.elsa:tst:202618465010" comment="edk2-tools-doc is signed with the Oracle Linux 10 key"/>
</criteria>
</criteria>
</criteria>
</criteria>
</criteria>

</definition>
</definitions>
<!--
 ~~~~~~~~~~~~~~~~~~~~~   rpminfo tests   ~~~~~~~~~~~~~~~~~~~~~ 
-->
<tests>
<rpminfo_test id="oval:com.oracle.elsa:tst:202618465001"  version="501" comment="Oracle Linux 10 is installed" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:202618465001" />
<state state_ref="oval:com.oracle.elsa:ste:202618465002" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:202618465002"  version="501" comment="Oracle Linux arch is aarch64" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:202618465001" />
<state state_ref="oval:com.oracle.elsa:ste:202618465003" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:202618465003"  version="501" comment="edk2-aarch64 is earlier than 0:20251114-5.0.1.el10_2" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:202618465002" />
<state state_ref="oval:com.oracle.elsa:ste:202618465004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:202618465004"  version="501" comment="edk2-aarch64 is signed with the Oracle Linux 10 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:202618465002" />
<state state_ref="oval:com.oracle.elsa:ste:202618465001" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:202618465005"  version="501" comment="edk2-ovmf is earlier than 0:20251114-5.0.1.el10_2" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:202618465003" />
<state state_ref="oval:com.oracle.elsa:ste:202618465004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:202618465006"  version="501" comment="edk2-ovmf is signed with the Oracle Linux 10 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:202618465003" />
<state state_ref="oval:com.oracle.elsa:ste:202618465001" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:202618465007"  version="501" comment="edk2-tools is earlier than 0:20251114-5.0.1.el10_2" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:202618465004" />
<state state_ref="oval:com.oracle.elsa:ste:202618465004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:202618465008"  version="501" comment="edk2-tools is signed with the Oracle Linux 10 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:202618465004" />
<state state_ref="oval:com.oracle.elsa:ste:202618465001" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:202618465009"  version="501" comment="edk2-tools-doc is earlier than 0:20251114-5.0.1.el10_2" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:202618465005" />
<state state_ref="oval:com.oracle.elsa:ste:202618465004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:202618465010"  version="501" comment="edk2-tools-doc is signed with the Oracle Linux 10 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:202618465005" />
<state state_ref="oval:com.oracle.elsa:ste:202618465001" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:202618465011"  version="501" comment="Oracle Linux arch is x86_64" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:202618465001" />
<state state_ref="oval:com.oracle.elsa:ste:202618465005" />
</rpminfo_test>

</tests>
<!--
 ~~~~~~~~~~~~~~~~~~~~   rpminfo objects   ~~~~~~~~~~~~~~~~~~~~ 
-->
<objects>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:202618465002" version="501">
<name>edk2-aarch64</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:202618465005" version="501">
<name>edk2-tools-doc</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:202618465004" version="501">
<name>edk2-tools</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:202618465003" version="501">
<name>edk2-ovmf</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:202618465001" version="501">
<name>oraclelinux-release</name>
</rpminfo_object>
</objects>
<states>
<!--
 ~~~~~~~~~~~~~~~~~~~~   rpminfo states   ~~~~~~~~~~~~~~~~~~~~~ 
-->
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:202618465001" version="501">
<signature_keyid operation="equals">bc4d06a08d8b756f</signature_keyid>
</rpminfo_state>
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:202618465002" version="501">
<version operation="pattern match">^10</version>
</rpminfo_state>
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:202618465003" version="501">
<arch operation="pattern match">aarch64</arch>
</rpminfo_state>
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:202618465004" version="501">
<evr datatype="evr_string" operation="less than">0:20251114-5.0.1.el10_2</evr>
</rpminfo_state>
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:202618465005" version="501">
<arch operation="pattern match">x86_64</arch>
</rpminfo_state>

</states>
</oval_definitions>
