CVE-2026-13199: Raspberry Pi 5 Information Disclosure Flaw

CVE-2026-13199 Overview

CVE-2026-13199 affects the EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices. The firmware generates non-random seed values for Kernel Address Space Layout Randomization (KASLR) and the Random Number Generator (RNG). Kernel addresses remain consistent across boots and across different devices, weakening a foundational exploit mitigation. The low-quality RNG seed also degrades the quality of random numbers produced early in boot or delays boot while the kernel accumulates entropy from other sources. The weakness maps to [CWE-331] Insufficient Entropy.

Critical Impact
Predictable KASLR offsets remove a key exploit mitigation, making memory corruption vulnerabilities in the kernel easier to weaponize on affected Raspberry Pi 5 and Compute Module 5 hardware.

Affected Products

Raspberry Pi 5
Raspberry Pi Compute Module 5
rpi-eeprom firmware prior to the fix in pull request 841

Discovery Timeline

2026-07-07 - CVE-2026-13199 published to the National Vulnerability Database (NVD)
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-13199

Vulnerability Analysis

The EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices supplies two seed values to the Linux kernel at boot. The first seed drives KASLR, which randomizes the kernel base address to hinder return-oriented programming and other memory corruption exploitation. The second seed feeds the kernel entropy pool used by the RNG.

Because the firmware produces non-random values, the KASLR offset is deterministic across boots and, in many cases, identical across separate devices of the same model. Attackers who obtain a leak from one device, or who study a reference device, can predict kernel addresses on any similar unit. This defeats a core defense-in-depth control that other kernel exploits typically must bypass.

The low-quality RNG seed compounds the issue. Applications that read from /dev/urandom immediately after boot may receive predictable output before higher-quality entropy sources contribute to the pool. In blocking configurations, boot may stall while entropy accumulates. The published advisories are the Raspberry Pi firmware fix and the Nozomi Networks Vulnerability Advisory.

Root Cause

The EEPROM firmware used a source that did not provide sufficient entropy when producing the KASLR and RNG seed values passed to the kernel. The generated values were repeatable and, across devices, non-unique. This constitutes Insufficient Entropy under [CWE-331].

Attack Vector

Exploitation requires local access to the target device. An attacker cannot trigger this weakness remotely without a prior foothold. In practice, an attacker who already holds local code execution can chain this issue with a separate kernel vulnerability. Knowing the kernel layout in advance removes the need for an information leak and makes exploit payloads reliable across the affected fleet.

Because no verified public exploit code has been published, this article describes the mechanism in prose. See the linked firmware pull request for the concrete change that introduces sufficient entropy in the seed generation path.

Detection Methods for CVE-2026-13199

Indicators of Compromise

No published indicators of compromise are associated with CVE-2026-13199 at this time.
Repeated identical KASLR base addresses across successive boots of the same device, visible in /proc/kallsyms when read as root, indicate the vulnerable firmware.
Matching kernel symbol addresses across two freshly imaged Raspberry Pi 5 devices running the same kernel build strongly suggest the deterministic seed condition.

Detection Strategies

Inventory Raspberry Pi 5 and Compute Module 5 devices and record the installed rpi-eeprom package version using rpi-eeprom-update.
Compare KASLR offsets between boots by scripting reads of /proc/kallsyms (as root) and hashing the results; identical hashes across boots indicate the unpatched firmware.
Audit early-boot consumers of /dev/urandom in application logs for artifacts that suggest low-entropy output, such as duplicate session tokens or TLS keys across devices.

Monitoring Recommendations

Track EEPROM firmware versions across managed Raspberry Pi fleets and alert when devices report versions predating the rpi-eeprom fix.
Monitor kernel logs for random: crng init timing anomalies that indicate delayed entropy availability.
Flag devices that report duplicate boot_id or machine-id values across the fleet, which can occur when early-boot randomness is deterministic.

How to Mitigate CVE-2026-13199

Immediate Actions Required

Update the rpi-eeprom package on all Raspberry Pi 5 and Compute Module 5 devices using the vendor package repository.
Apply the EEPROM firmware update with sudo rpi-eeprom-update -a and reboot each device to load the corrected firmware.
Rotate any cryptographic material generated on affected devices during early boot, including host SSH keys, TLS certificates, and API tokens.

Patch Information

The fix is delivered through the Raspberry Pi EEPROM firmware. The corrective change is tracked in the upstream rpi-eeprom pull request 841, which replaces the non-random seed source with a properly seeded generator for both the KASLR and RNG values passed to the kernel.

Workarounds

Configure userspace services to defer generation of long-lived keys until after systemd reports the kernel RNG is fully initialized, using systemd-random-seed or a ConditionKernelCommandLine guard.
Supplement kernel entropy with a hardware source such as a USB TRNG on high-value devices until the firmware is updated.
Restrict local access to affected devices, since exploitation of the deterministic KASLR relies on a local foothold combined with a separate kernel vulnerability.

bash

# Update Raspberry Pi EEPROM firmware to remediate CVE-2026-13199
sudo apt update
sudo apt install --only-upgrade rpi-eeprom
sudo rpi-eeprom-update -a
sudo reboot

# After reboot, confirm the updated firmware version
sudo rpi-eeprom-update