Debian Patches
Status for edk2/2026.02-3
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| brotlicompress-disable.diff | Do not attempt to compile removed BrotliCompress source BrotliCompress is not currently used, and including an embedded copy of its source could cause false-positives when scanning for security issues. This code is stripped from our orig.tar (at the request of the Ubuntu security team), so we also need to disable the build. |
dann frazier <dannf@debian.org> | not-needed | 2025-12-13 | ||
| x64-baseline-abi.patch | Explicitly target generic x86-64 ABI The system compiler may be configured to target a higher x86-64 psABI by default, so explicitly target the generic psABI to retain compatibility with older machine types. |
dann frazier <dannf@debian.org> | yes | 2025-12-13 | ||
| OvmfPkg-X64-add-opt-org.tianocore-UninstallMemAttrPr.patch | OvmfPkg/X64: add opt/org.tianocore/UninstallMemAttrProtocol support Add support for opt/org.tianocore/UninstallMemAttrProtocol, to allow turning off EFI_MEMORY_ATTRIBUTE_PROTOCOL, simliar to ArmVirtPkg. |
Gerd Hoffmann <kraxel@redhat.com> | no | debian | https://github.com/tianocore/edk2/pull/10667/commits/aa7f29a9e92b9e6f8b2e56bacaef6c96b8dc80ed | 2025-01-16 |
| CVE-2025-9232.patch | use_proxy(): Add missing terminating NUL byte Fixes CVE-2025-9232 There is a missing terminating NUL byte after strncpy() call. Issue and a proposed fix reported by Stanislav Fort (Aisle Research). (cherry picked from commit 6bca15039e99d37ce3a3564eb862a3b1ff40e63d) |
Tomas Mraz <tomas@openssl.org> | no | 2025-09-11 | ||
| ArmVirtPkg-ArmPlatformLibQemu-Support-early-ID-map-o.patch | ArmVirtPkg/ArmPlatformLibQemu: Support early ID map on LPA2 capable CPUs ArmVirtQemu uses an initial early ID map in emulated NOR flash that is activated right out of reset, in order to avoid running a good chunk of the SEC and PEI stages with the MMU and caches disabled. This early ID map is currently not compatible with LPA2, and the associated startup code consciously omits 52-bit physical addressing, as it was not supported for 4k page sizes when this code was written. This means that by the time ArmConfigureMmu() runs, the TCR control register is already programmed with a value that reflects the non-LPA2 nature of the active page tables. Given that the MMU is on at that point, TCR cannot simply be updated to a value that enables LPA2. Yet this is what happens currently, and so the boot hangs really early when running ArmVirtQemu on LPA2 capable CPUs. Disabling the MMU again at this point is problematic, because it would require cache maintenance on the stack and on other live RAM regions. Given that the early page tables are in read-only NOR flash, updating them on the fly to make them LPA2 compatible is impossible. So instead, provide a second set of early page tables, but using 5 levels of paging for LPA2, and omitting the shareability attributes in the page table descriptors, as LPA2 repurposes these bits as physical address bits. Also update the startup code to program TCR.IPS and TCR.DS accordingly, but only if LPA2 is supported and the PArange is 52 bits: this reflects the logic in ArmConfigureMmu(), ensuring that the TCR value it calculates is identical to the one chosen by the early code. diff --git a/ArmVirtPkg/Library/ArmPlatformLibQemu/ArmPlatformHelper.S b/ArmVirtPkg/Library/ArmPlatformLibQemu/ArmPlatformHelper.S index 55c01035bb..e0c720a16d 100644 |
Ard Biesheuvel <ardb@kernel.org> | no | https://github.com/tianocore/edk2/commit/b8df7d9c8e1e370b862890ebda677278c4c6155f | 2026-05-05 | |
| OvmfPkg-RiscVVirt-PlatformPei-Do-not-set-PcdTpmBaseA.patch | OvmfPkg/RiscVVirt/PlatformPei: Do not set PcdTpmBaseAddress to garbage If there is no TPM device in the device tree, the TpmBase variable is not initialized and contains garbage. Instead of using 0 as sentinel (which may be a valid address), check the size instead, which cannot be 0 for a memory-mapped device. diff --git a/OvmfPkg/RiscVVirt/PlatformPei/PlatformPeim.c b/OvmfPkg/RiscVVirt/PlatformPei/PlatformPeim.c index 3da71aa51b..fa157b4169 100644 |
Fabian Vogt <fvogt@suse.de> | no | https://github.com/tianocore/edk2/commit/b5d168944729e54cdd2fa45d9e83c14cacb36473 | 2026-03-06 | |
| BaseTools-Source-C-VfrCompile-Fix-parallel-make-fail.patch | BaseTools/Source/C/VfrCompile: Fix parallel make failures Update makefile rules to run antlr and dlg to completion before compiling any of the generated cpp files. Without this change, parallel make may start compiling some of the cpp files before both antlr and dlg have finished which produces syntax errors from compilation with partially generated files. Also use &: so the targets are treated as a group and the rule is only executed once for the entire group. Without this change, parallel make may run the rule actions more than once and modify the output while it is being used by another rule. diff --git a/BaseTools/Source/C/VfrCompile/GNUmakefile b/BaseTools/Source/C/VfrCompile/GNUmakefile index b469bd3f30..4f10b1d933 100644 |
Michael D Kinney <michael.d.kinney@intel.com> | no | https://github.com/tianocore/edk2/commit/9fc0aca51e83afda703963ea177feeb78a125cbc | 2026-02-24 |
All known versions for source package 'edk2'
- 2026.02-3 (sid)
- 2025.11-5 (forky)
- 2025.02-8+deb13u1 (trixie)
- 2022.11-6+deb12u2 (bookworm)
- 2022.11-6+deb12u1 (bookworm-security)