CVE-2026-13199: Predictable KASLR and RNG Seeds in Raspberry Pi 5 & CM5 EEPROM

Technical summary

CVE-2026-13199 affects the EEPROM firmware initialization on Raspberry Pi 5 and CM5 platforms. The vulnerability stems from insufficient entropy or a flawed algorithm in the KASLR (Kernel Address Space Layout Randomization) seed and RNG seed generation routines. KASLR is a critical mitigation that randomizes kernel memory layout on each boot; predictable KASLR seeds defeat this protection. Additionally, a low-quality RNG seed compromises cryptographic operations and system entropy pools that depend on the bootloader's contribution. The root cause appears to be CWE-331 (Insufficient Entropy), indicating the random number generation mechanism lacks adequate sources or mixing.

Business impact

For organizations deploying Raspberry Pi 5 or CM5 devices in production—whether as embedded systems, IoT gateways, edge computing nodes, or edge AI platforms—this vulnerability lowers the barrier to local privilege escalation or code execution attacks. An attacker with local access (USB, physical proximity, or compromised software running with low privilege) can more easily bypass ASLR-based mitigations and predict memory layouts. In sensitive environments handling cryptographic material or authentication, weak RNG seeding could degrade the strength of generated secrets. For consumer or educational deployments, the risk is lower unless the device is internet-facing or processes untrusted input.

Affected systems

Raspberry Pi 5 (all revisions) and Raspberry Pi Compute Module 5 (CM5) devices are affected. The vulnerability is in the EEPROM firmware, so impact depends on EEPROM version and boot configuration. Systems running current or recent Raspberry Pi OS versions will be affected if the EEPROM has not been updated. Other Linux distributions deployed on these platforms (e.g., Ubuntu, Fedora ARM variants) will also be vulnerable to the same firmware-level issue.

Exploitability

Exploitation requires local access to the affected system. An attacker cannot trigger this vulnerability remotely. However, once an attacker has local code execution (even unprivileged), they can predict kernel addresses and apply them in secondary exploits targeting kernel memory or services running as root. The CVSS score of 4.0 reflects that local access is required (AV:L) but no privileges are needed to observe the predictable addresses. Confidentiality impact is low because the attacker learns memory layout; integrity and availability are not directly affected by this vulnerability alone.

Remediation

Raspberry Pi Foundation has released updated EEPROM firmware that implements proper entropy gathering or uses a cryptographically sound random number generator. Users should update their EEPROM firmware using the rpi-eeprom-update utility (on Raspberry Pi OS) or equivalent tools on other distributions. Verify against the vendor advisory for the specific EEPROM version that includes the fix. No changes to the kernel, userland, or application configuration are required once the firmware is patched.

Patch guidance

Update EEPROM firmware to the patched version released by Raspberry Pi Foundation. On Raspberry Pi OS, run 'sudo rpi-eeprom-update' and follow prompts to install the latest firmware; a reboot is required. On other Linux distributions, consult the distribution's documentation or the Raspberry Pi Foundation's EEPROM release notes for the correct procedure. Verify that the new EEPROM version is installed by checking the output of 'vcgencmd otp_dump' or 'rpi-eeprom-config'. Test that the system boots normally and entropy sources are functioning (check /proc/sys/kernel/random/entropy_avail on subsequent boots).

Detection guidance

Detection at runtime is indirect: observe that kernel text and code segment addresses remain constant across multiple reboots of the same device, or that ASLR offsets show minimal variation. This can be checked via /proc/sys/kernel/perf_event_paranoid settings and reading /proc/*/maps or dmesg during early boot (if kernel logging is enabled). Firmware-level validation is difficult without access to EEPROM dump tools; rely instead on verifying EEPROM version via official Raspberry Pi Foundation documentation and confirming patches are applied. Intrusion detection should monitor for exploitation attempts that leverage fixed kernel addresses (e.g., ROP gadgets at predictable offsets).

Why prioritize this

Although the CVSS score is 4.0 (Medium), this vulnerability is worth prompt but not emergency patching. It is a foundational weakness that enables secondary attacks; by itself it does not cause data loss or system compromise, but it significantly eases exploitation of kernel vulnerabilities or privilege escalation flaws. Devices in high-security or production-critical roles (medical IoT, industrial controllers, cryptographic appliances) should be prioritized. Hobbyist or educational deployments can tolerate slightly longer patching windows, but all instances should eventually be updated.

Risk score, explained

The CVSS 3.1 score of 4.0 reflects a local-access-only vulnerability with low confidentiality impact and no direct impact on integrity or availability. The Attack Vector is Local (AV:L) because an attacker must run code on the device; Attack Complexity is Low (AC:L) because predicting kernel addresses requires no special conditions; Privileges Required is None (PR:N) because the predictable offsets are observable by unprivileged code; and User Interaction is None (UI:N). Confidentiality is Low (C:L) because kernel address disclosure aids reconnaissance for further attacks but does not leak user data directly. The score does not reflect the amplified risk when combined with other vulnerabilities, nor does it capture the broad reachability of Raspberry Pi devices in IoT and embedded contexts. Security teams should consider raising their internal priority if Raspberry Pi 5/CM5 devices are deployed at scale in their environment.

Frequently asked questions