[AutoPR- Security] Patch edk2 for CVE-2026-75803, CVE-2026-63076, CVE-2026-63074, CVE-2026-63072, CVE-2026-54874 [HIGH]

[Azure Linux Security Servicing Account (azurelinux-security)]

Auto Patch edk2 for CVE-2026-75803, CVE-2026-63076, CVE-2026-63074, CVE-2026-63072, CVE-2026-54874.

Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1191369&view=results

CVE-2026-75803 : Single Patch Backporter Pipeline Run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1191379&view=results
CVE-2026-54874 : Single Patch Backporter Pipeline Run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1191380&view=results

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

What does the PR accomplish, why was it needed?

• Auto Patch edk2 for CVE-2026-75803 (LOW), CVE-2026-63076 (HIGH), CVE-2026-63074 (MEDIUM), CVE-2026-63072 (MEDIUM), CVE-2026-54874 (MEDIUM).

Change Log

• CVE-2026-75803
• CVE-2026-63076
• CVE-2026-63074
• CVE-2026-63072
• CVE-2026-54874

Does this affect the toolchain?

YES/NO

Associated issues

• N/A

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2026-75803
• https://nvd.nist.gov/vuln/detail/CVE-2026-63076
• https://nvd.nist.gov/vuln/detail/CVE-2026-63074
• https://nvd.nist.gov/vuln/detail/CVE-2026-63072
• https://nvd.nist.gov/vuln/detail/CVE-2026-54874

Test Methodology

• Pipeline build id: Buddy Build URL

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Aditya Singh (v-aaditya)]

CVE-2026-54874 - Patch has been removed as it is being disputed.
Reasoning -

1. Spec line 459 executes CryptoPkg/Library/OpensslLib/configure.py
2. In the exact EDK2 3e722403cd16 configure.py, lines 37-42 pass no-dgram, no-dtls, no-dtls1-method, and no-dtls1_2-method to OpenSSL Configure.
3. The same openssl_configure function is called for all IA32, X64, and generic UEFI configurations before the script generates the INF source lists.
4. Because every OpenSSL configuration used to generate the EDK2 INF source lists receives no-dtls, the vulnerable DTLS record-buffering implementation is not compiled into or shipped

CVE-2026-63072 -

1. AI patch matches with upstream patch.
2. AI patch has upstream patch reference.
3. Patch applies cleanly.

CVE-2026-63074 -

1. AI patch matches with upstream patch.
2. AI patch has upstream patch reference.
3. Patch applies cleanly.

CVE-2026-63076 -

1. AI patch matches with upstream patch.
2. AI patch has upstream patch reference.
3. Patch applies cleanly.

CVE-2026-75803 -

1. AI patch matches with upstream patch.
2. AI patch has upstream patch reference.
3. Patch applies cleanly.

Re-triggered Buddy Build and it has passed.

[Aditya Singh (v-aaditya)]

Kindly update PR title to remove CVE-2026-54874.