Critical PXE Boot Flaw Puts Affected RHEL and OpenShift Systems at Risk

CVE-2026-97631 is a critical vulnerability in EDK2’s PXE network-boot driver, rated CVSS 8.8 by Red Hat. The flaw is an out-of-bounds write that may enable unauthenticated code execution before the operating system starts or cause a denial of service. Its reported exposure is specific: the affected driver processes network packets during a PXE boot sequence, before the operating system initializes. This makes the issue relevant to government and contractor environments that use affected Red Hat Enterprise Linux (RHEL) or OpenShift systems and rely on network boot workflows.

The source characterizes the vulnerable condition as arising when the PXE driver handles untrusted network traffic during pre-boot. As the original poster put it, “The vulnerability is exposed exclusively during network boot sequences when the PXE driver processes untrusted network packets before the operating system initializes.” For asset owners, that detail is important: the signal does not establish that every system using UEFI, TPM 2.0, or Secure Boot is vulnerable. Risk reviews should distinguish systems that actually use the affected RHEL or OpenShift configurations and PXE boot from other systems that merely have those broader firmware or security technologies.

For federal IT buyers, program offices, and contractors, the immediate procurement implication is operational rather than transactional. The report identifies no solicitation, award, funding announcement, or other procurement opportunity. Buyers and service providers should instead use the vulnerability details to focus asset discovery, vendor discussions, and remediation checks. In particular, teams should identify affected systems that PXE-boot, confirm applicable Red Hat errata, and coordinate remediation with system owners while accounting for the role those systems play in deployment, recovery, or data-center operations.

The issue also informs cybersecurity risk reviews for systems that process untrusted packets before the operating system is running, a stage that may not be covered by controls applied after startup. Government contractors supporting RHEL or OpenShift environments should validate scope against the affected configuration rather than treating all UEFI-enabled systems as exposed. The available report does not provide affected product versions, patch identifiers, remediation deadlines, or evidence of exploitation; those details should be confirmed through Red Hat’s authoritative advisories and the organization’s own asset and configuration records before making implementation decisions.

• CVE-2026-97631 affects EDK2’s PXE network-boot driver through an out-of-bounds write.
• Red Hat rated the vulnerability CVSS 8.8, indicating a critical security concern for systems within the affected scope.
• Potential consequences include unauthenticated code execution before the operating system starts or denial of service.
• Reported exposure is limited to affected RHEL and OpenShift environments during network boot.
• The original report says the PXE driver processes untrusted network packets before the operating system initializes.
• Government IT buyers and contractors should identify systems that actually PXE-boot and assess whether affected configurations are present.
• Verify remediation against Red Hat errata; the source does not specify patch identifiers, affected versions, or deadlines.
• Do not infer that all systems using UEFI, TPM 2.0, or Secure Boot are affected; the report does not establish that broader claim.
• Procurement teams can focus vendor and asset-management discussions on affected pre-boot configurations; no contract or procurement opportunity is reported.