CVE-2026-13199: Insufficient Entropy in Raspberry Pi 5 and Compute Module 5
EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR and RNG seed values. This resulted in consistent kernel addresses across boots and devices, potentially making it easier to exploit other vulnerabilities. Additionally, the low-quality RNG seed may affect the quality of random numbers or delay booting while sufficient entropy is accumulated from other sources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rpi-eeprom package (Raspberry Pi 5 / Compute Module 5)to a version that resolves this vulnerability.Fixed in 28.22-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13199?
CVE-2026-13199 has a medium severity rating of 5.1.
How do I fix CVE-2026-13199?
To resolve CVE-2026-13199, update the EEPROM firmware on your Raspberry Pi 5 or Compute Module 5 to the latest version.
What devices are affected by CVE-2026-13199?
CVE-2026-13199 affects the Raspberry Pi 5 and Compute Module 5 due to insufficient entropy in their EEPROM firmware.
What impact does CVE-2026-13199 have on security?
CVE-2026-13199 may lead to predictable kernel addresses and weak RNG seed values, increasing the risk of exploitation.
When was CVE-2026-13199 published?
CVE-2026-13199 was published on July 7, 2026.