CVE-2026-13199
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in the EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produces non-random KASLR and RNG seed values. This results in consistent kernel addresses across boots and devices, potentially making it easier to exploit other vulnerabilities. Additionally, the low-quality RNG seed may affect the quality of random numbers or delay booting while sufficient entropy is accumulated from other sources.
Risk Assessment
The organization faces an increased risk of attacks exploiting predictable kernel addresses, which could facilitate device compromise. Additionally, poor random number quality may weaken cryptographic security and other RNG-dependent mechanisms.
Recommendation
It is recommended to immediately update the EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices to the latest version that addresses this vulnerability. Monitor vendor announcements for patches.
Original NVD description (English source)
EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR and RNG seed values. This resulted in consistent kernel addresses across boots and devices, potentially making it easier to exploit other vulnerabilities. Additionally, the low-quality RNG seed may affect the quality of random numbers or delay booting while sufficient entropy is accumulated from other sources.