diff --git a/meta-arm/recipes-bsp/uefi/edk2-firmware/0001-DynamicTablesPkg-fix-SmbiosType2Genertor-build-failu.patch b/meta-arm/recipes-bsp/uefi/edk2-firmware/0001-DynamicTablesPkg-fix-SmbiosType2Genertor-build-failu.patch
index 0352beac6565..c2f1a3aca014 100644
--- a/meta-arm/recipes-bsp/uefi/edk2-firmware/0001-DynamicTablesPkg-fix-SmbiosType2Genertor-build-failu.patch
+++ b/meta-arm/recipes-bsp/uefi/edk2-firmware/0001-DynamicTablesPkg-fix-SmbiosType2Genertor-build-failu.patch
@@ -1,4 +1,4 @@
-From 7d2f6b6e31fad2c96c6fc55c17e79f8c96b4bfcf Mon Sep 17 00:00:00 2001
+From 0debd3a1f4b5abf0c75c26ec1e85d9fa33510c89 Mon Sep 17 00:00:00 2001
 From: Yeoreum Yun <yeoreum.yun@arm.com>
 Date: Mon, 10 Aug 2026 15:40:06 +0100
 Subject: [PATCH] DynamicTablesPkg: fix SmbiosType2Genertor build failure with
@@ -36,6 +36,3 @@ index 1250ef8059e9..5345d2b6d233 100644
    {
      DEBUG ((DEBUG_ERROR, "%a: Invalid Baseboard object list\n", __func__));
      return EFI_INVALID_PARAMETER;
--- 
-2.39.5
-
diff --git a/meta-arm/recipes-bsp/uefi/edk2-firmware/0002-NetworkPkg-UefiPxeBcDxe-Fix-ICMP-buffer-overflow-in-.patch b/meta-arm/recipes-bsp/uefi/edk2-firmware/0002-NetworkPkg-UefiPxeBcDxe-Fix-ICMP-buffer-overflow-in-.patch
new file mode 100644
index 000000000000..54c1da7b0c34
--- /dev/null
+++ b/meta-arm/recipes-bsp/uefi/edk2-firmware/0002-NetworkPkg-UefiPxeBcDxe-Fix-ICMP-buffer-overflow-in-.patch
@@ -0,0 +1,127 @@
+From 1c89a7982247eb994956140caf794f4f40e85de9 Mon Sep 17 00:00:00 2001
+From: santhoshkumarv <santhoshkumarv@ami.com>
+Date: Mon, 28 Sep 2026 06:06:24 -0700
+Subject: [PATCH] NetworkPkg/UefiPxeBcDxe: Fix ICMP buffer overflow in
+ IPv4/IPv6 handlers (CVE-2026-97631)
+
+Root Cause:
+Incorrect buffer copy logic in ICMP error handling allowed large packets
+to write beyond the allocated buffer. This could overwrite adjacent memory
+with attacker-controlled data, causing memory corruption.
+
+Resolution:
+Added proper boundary checks and corrected buffer offset calculations
+in IPv4 and IPv6 ICMP error handlers. Over sized ICMP error packets are now
+safely truncated when the buffer is full, preventing memory corruption.
+
+Signed-off-by: santhoshkumarV <santhoshkumarv@ami.com>
+
+Upstream-Status: Backport [560ed9b5b146ed622d7eb7c40254a9099bd65b84]
+CVE: CVE-2026-97631
+Signed-off-by: Jon Mason <jon.mason@arm.com>
+---
+ NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c | 68 ++++++++++----------------
+ 1 file changed, 26 insertions(+), 42 deletions(-)
+
+diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c b/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
+index 887ea3e7d7d8..9e97ba4904c7 100644
+--- a/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
++++ b/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
+@@ -252,6 +252,7 @@ PxeBcIcmpErrorDpcHandle (
+   UINTN                   Index;
+   UINT32                  CopiedLen;
+   UINT8                   *IcmpError;
++  UINT32                  FragmentLen;
+ 
+   Private = (PXEBC_PRIVATE_DATA *)Context;
+   Mode    = &Private->Mode;
+@@ -317,28 +318,19 @@ PxeBcIcmpErrorDpcHandle (
+   }
+ 
+   //
+-  // Copy the right ICMP error message into mode data.
++  // Copy ICMP error fragments into Mode->IcmpError in order. The maximum
++  // buffer size is sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR); truncate any excess.
+   //
+-  CopiedLen = 0;
+-  IcmpError = (UINT8 *)&Mode->IcmpError;
+-
+-  for (Index = 0; Index < RxData->FragmentCount; Index++) {
+-    CopiedLen += RxData->FragmentTable[Index].FragmentLength;
+-    if (CopiedLen <= sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR)) {
+-      CopyMem (
+-        IcmpError,
+-        RxData->FragmentTable[Index].FragmentBuffer,
+-        RxData->FragmentTable[Index].FragmentLength
+-        );
+-    } else {
+-      CopyMem (
+-        IcmpError,
+-        RxData->FragmentTable[Index].FragmentBuffer,
+-        CopiedLen - sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR)
+-        );
+-    }
+-
+-    IcmpError += CopiedLen;
++  for (Index = 0, IcmpError = (UINT8 *)&Mode->IcmpError, CopiedLen = 0;
++       (Index < RxData->FragmentCount) &&
++       (CopiedLen < sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR));
++       Index++, IcmpError += FragmentLen, CopiedLen += FragmentLen)
++  {
++    FragmentLen = MIN (
++                    RxData->FragmentTable[Index].FragmentLength,
++                    (UINT32)(sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR) - CopiedLen)
++                    );
++    CopyMem (IcmpError, RxData->FragmentTable[Index].FragmentBuffer, FragmentLen);
+   }
+ 
+ ON_RECYCLE:
+@@ -387,6 +379,7 @@ PxeBcIcmp6ErrorDpcHandle (
+   UINT8                   Type;
+   UINT32                  CopiedLen;
+   UINT8                   *Icmp6Error;
++  UINT32                  FragmentLen;
+ 
+   Private = (PXEBC_PRIVATE_DATA *)Context;
+   Mode    = &Private->Mode;
+@@ -449,28 +442,19 @@ PxeBcIcmp6ErrorDpcHandle (
+   }
+ 
+   //
+-  // Copy the right ICMP6 error message into mode data.
++  // Copy ICMP error fragments into Mode->IcmpError in order. The maximum
++  // buffer size is sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR); truncate any excess.
+   //
+-  CopiedLen  = 0;
+-  Icmp6Error = (UINT8 *)&Mode->IcmpError;
+-
+-  for (Index = 0; Index < RxData->FragmentCount; Index++) {
+-    CopiedLen += RxData->FragmentTable[Index].FragmentLength;
+-    if (CopiedLen <= sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR)) {
+-      CopyMem (
+-        Icmp6Error,
+-        RxData->FragmentTable[Index].FragmentBuffer,
+-        RxData->FragmentTable[Index].FragmentLength
+-        );
+-    } else {
+-      CopyMem (
+-        Icmp6Error,
+-        RxData->FragmentTable[Index].FragmentBuffer,
+-        CopiedLen - sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR)
+-        );
+-    }
+-
+-    Icmp6Error += CopiedLen;
++  for (Index = 0, Icmp6Error = (UINT8 *)&Mode->IcmpError, CopiedLen = 0;
++       (Index < RxData->FragmentCount) &&
++       (CopiedLen < sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR));
++       Index++, Icmp6Error += FragmentLen, CopiedLen += FragmentLen)
++  {
++    FragmentLen = MIN (
++                    RxData->FragmentTable[Index].FragmentLength,
++                    (UINT32)(sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR) - CopiedLen)
++                    );
++    CopyMem (Icmp6Error, RxData->FragmentTable[Index].FragmentBuffer, FragmentLen);
+   }
+ 
+ ON_RECYCLE:
diff --git a/meta-arm/recipes-bsp/uefi/edk2-firmware/0003-NetworkPkg-UefiPxeBcDxe-Clear-ICMP-error-buffer-befo.patch b/meta-arm/recipes-bsp/uefi/edk2-firmware/0003-NetworkPkg-UefiPxeBcDxe-Clear-ICMP-error-buffer-befo.patch
new file mode 100644
index 000000000000..f0d07bc59719
--- /dev/null
+++ b/meta-arm/recipes-bsp/uefi/edk2-firmware/0003-NetworkPkg-UefiPxeBcDxe-Clear-ICMP-error-buffer-befo.patch
@@ -0,0 +1,38 @@
+From bff45da697fecf64927fbc38eacfcf41f20b763b Mon Sep 17 00:00:00 2001
+From: Michael D Kinney <michael.d.kinney@intel.com>
+Date: Wed, 14 Oct 2026 12:34:35 -0700
+Subject: [PATCH] NetworkPkg/UefiPxeBcDxe: Clear ICMP error buffer before
+ copying
+
+Zero the ICMP error buffer before copying fragments so short packets do not
+leave stale bytes from a previous error.
+
+Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
+
+Upstream-Status: Backport [fa789071ff0b29f1e568bfe153ef7f3d76bd60e4]
+CVE: CVE-2026-97631
+Signed-off-by: Jon Mason <jon.mason@arm.com>
+---
+ NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c b/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
+index 9e97ba4904c7..7795e4f187d2 100644
+--- a/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
++++ b/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
+@@ -321,6 +321,7 @@ PxeBcIcmpErrorDpcHandle (
+   // Copy ICMP error fragments into Mode->IcmpError in order. The maximum
+   // buffer size is sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR); truncate any excess.
+   //
++  ZeroMem (&Mode->IcmpError, sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR));
+   for (Index = 0, IcmpError = (UINT8 *)&Mode->IcmpError, CopiedLen = 0;
+        (Index < RxData->FragmentCount) &&
+        (CopiedLen < sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR));
+@@ -445,6 +446,7 @@ PxeBcIcmp6ErrorDpcHandle (
+   // Copy ICMP error fragments into Mode->IcmpError in order. The maximum
+   // buffer size is sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR); truncate any excess.
+   //
++  ZeroMem (&Mode->IcmpError, sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR));
+   for (Index = 0, Icmp6Error = (UINT8 *)&Mode->IcmpError, CopiedLen = 0;
+        (Index < RxData->FragmentCount) &&
+        (CopiedLen < sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR));
diff --git a/meta-arm/recipes-bsp/uefi/edk2-firmware_202608.bb b/meta-arm/recipes-bsp/uefi/edk2-firmware_202608.bb
index 5008fcca467b..5411e7b186ec 100644
--- a/meta-arm/recipes-bsp/uefi/edk2-firmware_202608.bb
+++ b/meta-arm/recipes-bsp/uefi/edk2-firmware_202608.bb
@@ -4,4 +4,8 @@ SRCREV_edk2           ?= "2970e5699ba6267f3384ffab20f96647578aebc8"
 SRCREV_edk2-platforms ?= "c98cdf8de9bd84a3267623e64f4388e21de69512"
 
 FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
-SRC_URI += "file://0001-DynamicTablesPkg-fix-SmbiosType2Genertor-build-failu.patch"
+SRC_URI += " \
+        file://0001-DynamicTablesPkg-fix-SmbiosType2Genertor-build-failu.patch \
+        file://0002-NetworkPkg-UefiPxeBcDxe-Fix-ICMP-buffer-overflow-in-.patch \
+        file://0003-NetworkPkg-UefiPxeBcDxe-Clear-ICMP-error-buffer-befo.patch \
+       "