# CVE-2026-54874: Excessive Memory Use Buffering DTLS Records for a Future Epoch CVE-2026-54874 is fixed in 36 products on 1 platform, first by efi-shell-aa64 2024.02-2ubuntu0.10, released August 24, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-54874 - Priority: High - CVSS: 7.5 (Moderate) - EPSS: 0.0062 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Aug 24, 2026 - Weakness: Asymmetric Resource Consumption (Amplification) - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54874 ## Description Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early records so that they can be processed once the local endpoint catches up. Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an application already places on the number of concurrent associations also bounds the total exposure, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web Services Fixed by: Matt Caswell ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | efi-shell-aa64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-aa64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-aa64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | efi-shell-aa64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [efi-shell-aa64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-efi-shell-aa64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | efi-shell-arm Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-arm 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-arm-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | efi-shell-ia32 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-ia32 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-ia32-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | efi-shell-loongarch64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [efi-shell-loongarch64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-efi-shell-loongarch64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | efi-shell-riscv64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-riscv64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-riscv64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | efi-shell-riscv64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [efi-shell-riscv64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-efi-shell-riscv64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | efi-shell-x64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-x64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-x64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | efi-shell-x64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [efi-shell-x64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-efi-shell-x64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | libssl1.0.0 Ubuntu 18.04.6 LTS (bionic) | 1.0.2n-1ubuntu5.13+esm6 | [libssl1.0.0 1.0.2n-1ubuntu5.13+esm6](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libssl1.0.0-1.0.2n-1ubuntu5.13-esm6.md) | Aug 27, 2026 | | Linux | libssl1.1 Ubuntu 18.04.6 LTS (bionic) | 1.1.1-1ubuntu2.1~18.04.23+esm10 | [libssl1.1 1.1.1-1ubuntu2.1~18.04.23+esm10](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libssl1.1-1.1.1-1ubuntu2.1-18.04.23-esm10.md) | Aug 27, 2026 | | Linux | libssl1.1 Ubuntu 20.04 LTS (focal) | 1.1.1f-1ubuntu2.24+esm5 | [libssl1.1 1.1.1f-1ubuntu2.24+esm5](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libssl1.1-1.1.1f-1ubuntu2.24-esm5.md) | Aug 27, 2026 | | Linux | libssl3 Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.29 | [libssl3 3.0.2-0ubuntu1.29](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libssl3-3.0.2-0ubuntu1.29.md) | Aug 27, 2026 | | Linux | libssl3t64 Ubuntu 24.04.5 LTS (noble) | 3.0.13-0ubuntu3.15 | [libssl3t64 3.0.13-0ubuntu3.15](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libssl3t64-3.0.13-0ubuntu3.15.md) | Aug 27, 2026 | | Linux | libssl3t64 Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.4 | [libssl3t64 3.5.5-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libssl3t64-3.5.5-1ubuntu3.4.md) | Aug 24, 2026 | | Linux | openssl Debian 12.15 (bookworm) | 3.0.22-1~deb12u1 | [DEBIAN-CVE-2026-54874](https://patchblox.com/security/data/fix/linux/debian-cve-2026-54874.md) | Aug 26, 2026 | | Linux | openssl Debian 13.5 (trixie) | 3.5.7-1~deb13u2 | [DEBIAN-CVE-2026-54874](https://patchblox.com/security/data/fix/linux/debian-cve-2026-54874.md) | Aug 26, 2026 | | Linux | openssl Debian 14 | 3.6.4-1 | [DEBIAN-CVE-2026-54874](https://patchblox.com/security/data/fix/linux/debian-cve-2026-54874.md) | Aug 26, 2026 | | Linux | openssl RHEL 10 | 3.5.8-1.el10_2 | [RHSA-2026:67154](https://patchblox.com/security/data/fix/linux/rhsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl Ubuntu 18.04.6 LTS (bionic) | 1.1.1-1ubuntu2.1~18.04.23+esm10 | [openssl 1.1.1-1ubuntu2.1~18.04.23+esm10](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openssl-1.1.1-1ubuntu2.1-18.04.23-esm10.md) | Aug 27, 2026 | | Linux | openssl Ubuntu 20.04 LTS (focal) | 1.1.1f-1ubuntu2.24+esm5 | [openssl 1.1.1f-1ubuntu2.24+esm5](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openssl-1.1.1f-1ubuntu2.24-esm5.md) | Aug 27, 2026 | | Linux | openssl Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.29 | [openssl 3.0.2-0ubuntu1.29](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-openssl-3.0.2-0ubuntu1.29.md) | Aug 27, 2026 | | Linux | openssl Ubuntu 24.04.5 LTS (noble) | 3.0.13-0ubuntu3.15 | [openssl 3.0.13-0ubuntu3.15](https://patchblox.com/security/data/fix/linux/ubuntu-noble-openssl-3.0.13-0ubuntu3.15.md) | Aug 27, 2026 | | Linux | openssl Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.4 | [openssl 3.5.5-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-openssl-3.5.5-1ubuntu3.4.md) | Aug 24, 2026 | | Linux | openssl almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 | | Linux | openssl ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 | | Linux | openssl rocky 10 | 1:3.5.8-1.el10_2 | [RLSA-2026:67154](https://patchblox.com/security/data/fix/linux/rlsa-2026-67154.md) | Sep 15, 2026 | | Linux | openssl rocky 9 | 1:3.5.8-1.el9_8 | [RLSA-2026:67165](https://patchblox.com/security/data/fix/linux/rlsa-2026-67165.md) | Sep 15, 2026 | | Linux | openssl-1_1 sles 15.6 | 1.1.1w-150600.5.38.1 | [SUSE-SU-2026:3878-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3878-1.md) | Aug 31, 2026 | | Linux | openssl-1_1 sles 15.7 | 1.1.1w-150700.11.30.1 | [SUSE-SU-2026:4041-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4041-1.md) | Sep 7, 2026 | | Linux | openssl-3 opensuse-leap 16.0 | 3.5.0-160000.10.1 | [OPENSUSE-SU-2026:21744-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21744-1.md) | Sep 2, 2026 | | Linux | openssl-3 sles 15.6 | 3.1.4-150600.5.64.1 | [SUSE-SU-2026:3866-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3866-1.md) | Aug 28, 2026 | | Linux | openssl-3 sles 15.7 | 3.5.0-150700.5.50.1 | [SUSE-SU-2026:4039-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4039-1.md) | Sep 7, 2026 | | Linux | openssl-3 sles 16.0 | 3.5.0-160000.10.1 | [SUSE-SU-2026:23609-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23609-1.md) | Sep 2, 2026 | | Linux | openssl-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-debugsource amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-devel RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl-devel almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl-devel almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl-devel amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-devel ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 | | Linux | openssl-devel ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 | | Linux | openssl-fips-provider-latest amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-fips-provider-latest-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-libs RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl-libs almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl-libs almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl-libs amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-libs ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 | | Linux | openssl-libs ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 | | Linux | openssl-libs-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-perl RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl-perl almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl-perl almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl-perl amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-perl ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 | | Linux | openssl-perl ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 | | Linux | openssl-provider-legacy Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.4 | [openssl-provider-legacy 3.5.5-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-openssl-provider-legacy-3.5.5-1ubuntu3.4.md) | Aug 24, 2026 | | Linux | openssl-snapsafe-libs amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-snapsafe-libs-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl1.0 Ubuntu 18.04.6 LTS (bionic) | 1.0.2n-1ubuntu5.13+esm6 | [openssl1.0 1.0.2n-1ubuntu5.13+esm6](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openssl1.0-1.0.2n-1ubuntu5.13-esm6.md) | Aug 27, 2026 | | Linux | ovmf Ubuntu 18.04.6 LTS (bionic) | 0~20180205.c0d9813c-2ubuntu0.3+esm3 | [ovmf 0~20180205.c0d9813c-2ubuntu0.3+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-ovmf-0-20180205.c0d9813c-2ubuntu0.3-esm3.md) | Aug 24, 2026 | | Linux | ovmf Ubuntu 20.04 LTS (focal) | 0~20191122.bd85bf54-2ubuntu3.6+esm1 | [ovmf 0~20191122.bd85bf54-2ubuntu3.6+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-ovmf-0-20191122.bd85bf54-2ubuntu3.6-esm1.md) | Aug 24, 2026 | | Linux | ovmf Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.7 | [ovmf 2022.02-3ubuntu0.22.04.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-ovmf-2022.02-3ubuntu0.22.04.7.md) | Aug 24, 2026 | | Linux | ovmf Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [ovmf 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ovmf-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | ovmf Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | ovmf-amdsev Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf-amdsev 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-amdsev-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | ovmf-generic Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf-generic 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-generic-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | ovmf-ia32 Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.7 | [ovmf-ia32 2022.02-3ubuntu0.22.04.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-ovmf-ia32-2022.02-3ubuntu0.22.04.7.md) | Aug 24, 2026 | | Linux | ovmf-ia32 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [ovmf-ia32 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ovmf-ia32-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | ovmf-inteltdx Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf-inteltdx 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-inteltdx-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | ovmf-legacy Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [ovmf-legacy 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ovmf-legacy-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | ovmf-legacy Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf-legacy 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-legacy-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | qemu-efi Ubuntu 18.04.6 LTS (bionic) | 0~20180205.c0d9813c-2ubuntu0.3+esm3 | [qemu-efi 0~20180205.c0d9813c-2ubuntu0.3+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-qemu-efi-0-20180205.c0d9813c-2ubuntu0.3-esm3.md) | Aug 24, 2026 | | Linux | qemu-efi Ubuntu 20.04 LTS (focal) | 0~20191122.bd85bf54-2ubuntu3.6+esm1 | [qemu-efi 0~20191122.bd85bf54-2ubuntu3.6+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-qemu-efi-0-20191122.bd85bf54-2ubuntu3.6-esm1.md) | Aug 24, 2026 | | Linux | qemu-efi Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.7 | [qemu-efi 2022.02-3ubuntu0.22.04.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-efi-2022.02-3ubuntu0.22.04.7.md) | Aug 24, 2026 | | Linux | qemu-efi-aarch64 Ubuntu 18.04.6 LTS (bionic) | 0~20180205.c0d9813c-2ubuntu0.3+esm3 | [qemu-efi-aarch64 0~20180205.c0d9813c-2ubuntu0.3+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-qemu-efi-aarch64-0-20180205.c0d9813c-2ubuntu0.3-esm3.md) | Aug 24, 2026 | | Linux | qemu-efi-aarch64 Ubuntu 20.04 LTS (focal) | 0~20191122.bd85bf54-2ubuntu3.6+esm1 | [qemu-efi-aarch64 0~20191122.bd85bf54-2ubuntu3.6+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-qemu-efi-aarch64-0-20191122.bd85bf54-2ubuntu3.6-esm1.md) | Aug 24, 2026 | | Linux | qemu-efi-aarch64 Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.7 | [qemu-efi-aarch64 2022.02-3ubuntu0.22.04.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-efi-aarch64-2022.02-3ubuntu0.22.04.7.md) | Aug 24, 2026 | | Linux | qemu-efi-aarch64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [qemu-efi-aarch64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-qemu-efi-aarch64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | qemu-efi-aarch64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [qemu-efi-aarch64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-qemu-efi-aarch64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | qemu-efi-arm Ubuntu 18.04.6 LTS (bionic) | 0~20180205.c0d9813c-2ubuntu0.3+esm3 | [qemu-efi-arm 0~20180205.c0d9813c-2ubuntu0.3+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-qemu-efi-arm-0-20180205.c0d9813c-2ubuntu0.3-esm3.md) | Aug 24, 2026 | | Linux | qemu-efi-arm Ubuntu 20.04 LTS (focal) | 0~20191122.bd85bf54-2ubuntu3.6+esm1 | [qemu-efi-arm 0~20191122.bd85bf54-2ubuntu3.6+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-qemu-efi-arm-0-20191122.bd85bf54-2ubuntu3.6-esm1.md) | Aug 24, 2026 | | Linux | qemu-efi-arm Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.7 | [qemu-efi-arm 2022.02-3ubuntu0.22.04.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-efi-arm-2022.02-3ubuntu0.22.04.7.md) | Aug 24, 2026 | | Linux | qemu-efi-arm Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [qemu-efi-arm 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-qemu-efi-arm-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | qemu-efi-loongarch64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [qemu-efi-loongarch64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-qemu-efi-loongarch64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | qemu-efi-riscv64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [qemu-efi-riscv64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-qemu-efi-riscv64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | qemu-efi-riscv64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [qemu-efi-riscv64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-qemu-efi-riscv64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | --- Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.