Red Hat Fixes EDK II PXE Pre-Boot Code Execution on RHEL 10

Quick Answer

Check EDK II on RHEL 10. Apply RHSA-2026:96240 from the matching entitled repository. Confirm the updated firmware package and the firmware used by affected guests, then test boot and required PXE workflows.

Last verified: 2026-11-09 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.

Scope And Authority

Product scope	RHEL 10; EDK II
Advisory	RHSA-2026:96240
CVE	CVE-2026-97631
Authoritative release date	November 9, 2026 at 12:10:27 UTC, from Red Hat CSAF initial_release_date.
Authority revision date	Red Hat records the substantive last-updated version at 2026-11-09T12:10:27+00:00. The CSAF generation timestamp is 2026-11-09T16:41:28+00:00; generation alone is not a material advisory revision.
Affected versions	RHEL 10: installations of the EDK II packages requiring RHSA-2026:96240. Match the full installed RPM, architecture and repository to the vendor product tree; a universal upstream version range is not stated.
Fixed version	edk2-0:20251114-5.el10_2.3
CVSS base score	8.8 (highest authority-stated CVSS 3.1 base score)
CVSS severity	High (CVSS); Critical (Red Hat impact)
Exploitation status	Red Hat does not state exploitation in this advisory.; no exploitation claim is inferred.

Authority CVSS by Vulnerability

CVE-2026-97631	CVSS 3.1: 8.8 (High)

What Changed

Red Hat released RHSA-2026:96240 for RHEL 10, addressing a pre-boot remote-code-execution flaw in the EDK II PXE driver. The update provides the distribution packages listed below; keep the Red Hat release and support channel matched during remediation.

What To Validate Now

1. Inventory. Record edk2 packages, UEFI guest firmware, PXE boot paths and virtualization-host ownership.
2. Establish applicability. RHEL 10: installations of the EDK II packages requiring RHSA-2026:96240. Match the full installed RPM, architecture and repository to the vendor product tree; a universal upstream version range is not stated.
3. Remediate. Apply RHSA-2026:96240 through the entitled Red Hat repositories. The fixed source build is edk2-0:20251114-5.el10_2.3. Install the matching binary packages for the supported stream and architecture.
4. Validate. Confirm the updated firmware package and the firmware used by affected guests, then test boot and required PXE workflows.
5. Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.

Operational Cautions

Coordinate guest shutdown, firmware adoption and recovery with the virtualization owner. Updating a host package alone does not prove an existing guest uses the corrected firmware; avoid changing boot policy without a recovery path.

Evidence To Retain

• Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
• UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
• Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• RHSA-2026:96240

Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.

• Red Hat CSAF advisory and product/package matrix

Advisory facts are attributed to Red Hat Inc. The linked CSAF content is licensed under CC BY 4.0; TechGeeks operational guidance is summarized for this notice.