[AutoPR- Security] Patch edk2 for CVE-2026-75803, CVE-2026-63076, CVE-2026-63074, CVE-2026-63072 [HIGH]

[Azure Linux Security Servicing Account (azurelinux-security)]

Auto Patch edk2 for CVE-2026-75803, CVE-2026-63076, CVE-2026-63074, CVE-2026-63072.

Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1191369&view=results

CVE-2026-75803 : Single Patch Backporter Pipeline Run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1191379&view=results

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

What does the PR accomplish, why was it needed?

• Auto Patch edk2 for CVE-2026-75803 (LOW), CVE-2026-63076 (HIGH), CVE-2026-63074 (MEDIUM), CVE-2026-63072 (MEDIUM)

Change Log

• CVE-2026-75803
• CVE-2026-63076
• CVE-2026-63074
• CVE-2026-63072

Does this affect the toolchain?

YES/NO

Associated issues

• N/A

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2026-75803
• https://nvd.nist.gov/vuln/detail/CVE-2026-63076
• https://nvd.nist.gov/vuln/detail/CVE-2026-63074
• https://nvd.nist.gov/vuln/detail/CVE-2026-63072

Test Methodology

• Pipeline build id: Buddy Build URL

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Aditya Singh (v-aaditya)]

CVE-2026-54874 - Patch has been removed as it is being disputed.
Reasoning -

1. Spec line 459 executes CryptoPkg/Library/OpensslLib/configure.py
2. In the exact EDK2 3e722403cd16 configure.py, lines 37-42 pass no-dgram, no-dtls, no-dtls1-method, and no-dtls1_2-method to OpenSSL Configure.
3. The same openssl_configure function is called for all IA32, X64, and generic UEFI configurations before the script generates the INF source lists.
4. Because every OpenSSL configuration used to generate the EDK2 INF source lists receives no-dtls, the vulnerable DTLS record-buffering implementation is not compiled into or shipped

CVE-2026-63072 -

1. AI patch matches with upstream patch.
2. AI patch has upstream patch reference.
3. Patch applies cleanly.

CVE-2026-63074 -

1. AI patch matches with upstream patch.
2. AI patch has upstream patch reference.
3. Patch applies cleanly.

CVE-2026-63076 -

1. AI patch matches with upstream patch.
2. AI patch has upstream patch reference.
3. Patch applies cleanly.

CVE-2026-75803 -

1. AI patch matches with upstream patch.
2. AI patch has upstream patch reference.
3. Patch applies cleanly.

Re-triggered Buddy Build and it has passed.

[Aditya Singh (v-aaditya)]

Kindly update PR title to remove CVE-2026-54874.

[jslobodzian]

[Toolio Iglesias🗺️]

kanishk Bansal — flagging a title/content discrepancy on this PR for your awareness:

The PR title and Summary list 5 CVEs (CVE-2026-75803, CVE-2026-63076, CVE-2026-63074, CVE-2026-63072, CVE-2026-54874), but the actual change only adds 4 patch files and the edk2.spec changelog only records 4 CVEs:

• ✅ CVE-2026-63072 → Patch1026
• ✅ CVE-2026-63074 → Patch1027
• ✅ CVE-2026-63076 → Patch1028
• ✅ CVE-2026-75803 → Patch1029
• ❌ CVE-2026-54874 — no patch file, not referenced in the spec, not in the changelog. It is not addressed by this PR.

The spec is internally consistent for the 4 CVEs it does patch (Release 18→19, signed variant bumped in lockstep, FT build 1192826 green). But please confirm whether CVE-2026-54874 was intentionally dropped (e.g., no backport available yet) or accidentally omitted — and either update the title/Summary to match, or add the missing patch before this merges.

[Aditya Singh (v-aaditya)]

[Toolio Iglesias🗺️]

kanishk Bansal — flagging a title/content discrepancy on this PR for your awareness:

The PR title and Summary list 5 CVEs (CVE-2026-75803, CVE-2026-63076, CVE-2026-63074, CVE-2026-63072, CVE-2026-54874), but the actual change only adds 4 patch files and the edk2.spec changelog only records 4 CVEs:

• ✅ CVE-2026-63072 → Patch1026
• ✅ CVE-2026-63074 → Patch1027
• ✅ CVE-2026-63076 → Patch1028
• ✅ CVE-2026-75803 → Patch1029
• ❌ CVE-2026-54874 — no patch file, not referenced in the spec, not in the changelog. It is not addressed by this PR.

The spec is internally consistent for the 4 CVEs it does patch (Release 18→19, signed variant bumped in lockstep, FT build 1192826 green). But please confirm whether CVE-2026-54874 was intentionally dropped (e.g., no backport available yet) or accidentally omitted — and either update the title/Summary to match, or add the missing patch before this merges.

jslobodzian - The patch for CVE-2026-54874 has been removed as it has been disputed after discussing with the MSRC team. Refer PR comment - #18638 (comment)

Kanishk Bansal (@Kanishk-Bansal) - Could you please update the PR, as it still has references of CVE-2026-54874 in sections such as Summary, Change Log and Link to CVEs.

[Kanishk Bansal (Kanishk-Bansal)]

Done