CVE-2025-2296 Un-verified kernel bypass Secure Boot mechanism in direct boot mode
Local attackers can bypass Secure Boot in EDK2 direct boot mode to execute arbitrary commands, compromising system integrity and confidentiality.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-2296?
CVE-2025-2296 is a high-severity vulnerability in TianoCore EDK2, published on 9 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
EDK2 contains a vulnerability in BIOS where an attacker may cause “ Improper Input Validation” by local access. Successful exploitation of this vulnerability could alter control flow in unexpected ways, potentially allowing arbitrary command execution and impacting Confidentiality, Integrity, and Availability.
Weakness: CWE-20
Which versions are affected by CVE-2025-2296?
Linux distribution packages (13)
edk2-aarch64 AlmaLinux:10 | All versions | 20251114-5.el10_2 |
edk2-ovmf AlmaLinux:10 | All versions | 20251114-5.el10_2 |
edk2-tools AlmaLinux:10 | All versions | 20251114-5.el10_2 |
edk2-tools-doc AlmaLinux:10 | All versions | 20251114-5.el10_2 |
edk2 Red Hat:enterprise_linux:10.2 | All versions | 0:20251114-5.el10_2 |
edk2-aarch64 Red Hat:enterprise_linux:10.2 | All versions | 0:20251114-5.el10_2 |
edk2-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:20251114-5.el10_2 |
edk2-ovmf Red Hat:enterprise_linux:10.2 | All versions | 0:20251114-5.el10_2 |
edk2-tools Red Hat:enterprise_linux:10.2 | All versions | 0:20251114-5.el10_2 |
edk2-tools-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:20251114-5.el10_2 |
edk2-tools-doc Red Hat:enterprise_linux:10.2 | All versions | 0:20251114-5.el10_2 |
edk2 Rocky Linux:10 | All versions | 0:20251114-5.el10 |
ovmf openSUSE:Tumbleweed | All versions | 202602-6.1 |
How do I fix CVE-2025-2296?
Apply the vendor's patch.
Is CVE-2025-2296 being exploited?
There is no known exploitation of CVE-2025-2296 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:18465, AZL-72545, AZL-72556, AZL-72559, BELL-CVE-2025-2296, DEBIAN-CVE-2025-2296 and 6 more.