CVE-2026-13199 Raspberry Pi CVE debrief

Who should care

Users of Raspberry Pi 5 and Compute Module 5 devices should verify their EEPROM firmware version and update to a fixed version if necessary. Additionally, users should monitor for other potential vulnerabilities that may be exploited in conjunction with this issue. Security teams and platform operators should review the vulnerability and assess their exposure.

Technical summary

EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR and RNG seed values, resulting in consistent kernel addresses across boots and devices. This may make it easier to exploit other vulnerabilities. The low-quality RNG seed may affect the quality of random numbers or delay booting while sufficient entropy is accumulated from other sources. The vulnerability requires local access and may be used to exploit other vulnerabilities.

Defensive priority

Medium priority, as the vulnerability requires local access and may be used to exploit other vulnerabilities.

Recommended defensive actions

• Verify EEPROM firmware version on Raspberry Pi 5 and Compute Module 5 devices
• Update to a fixed firmware version if necessary
• Monitor for other potential vulnerabilities that may be exploited in conjunction with this issue
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is needed to determine the full scope of the issue and potential mitigations. The Raspberry Pi 5 and Compute Module 5 devices' EEPROM firmware produced non-random KASLR and RNG seed values, which may be used to exploit other vulnerabilities. The low-quality RNG seed may affect the quality of random numbers or delay booting while sufficient entropy is accumulated from other sources. No additional details are available from the CVE record or NVD entry.

Official resources