How-To: Find and Fence Off Network Boot Before the EDK II Fix Ships

With the EDK II PXE flaw unpatched for most people, here’s the checklist I’m running on my own lab gear.

Review before you run anything: read the docs yourself, back up your config, and try it somewhere you can afford to break first.

1. See what boots from the network

On each Linux box, list the UEFI boot entries:

sudo efibootmgr -v

Look for entries with PXE, IPv4, IPv6 or HTTP in them, and check BootOrder to see if any come before your disk.

2. Turn it off where you don’t need it

Disable network boot in the firmware setup. Removing the entry with efibootmgr isn’t enough, since some firmware recreates it at boot.

3. Fence it where you do need it

• Keep PXE on its own VLAN, with only the provisioning server and the machines being built.
• Don’t let user or guest networks reach it.

4. Watch for firmware

fwupdmgr refresh
fwupdmgr get-updates

Also watch your board or server vendor’s advisories for CVE-2026-97631, because most fixes will come from them, not straight from EDK II.

God Bless, and Needs Garlic!

References & Further Reading

• Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot (The Hacker News)
• efibootmgr (GitHub)
• fwupd