Insufficient Entropy in Raspberry Pi 5 and Compute Module 5
Priority LOW 22CWE-331Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR and RNG seed values. This resulted in consistent kernel addresses across boots and devices, potentially making it easier to exploit other vulnerabilities. Additionally, the low-quality RNG seed may affect the quality of random numbers or delay booting while sufficient entropy is accumulated from other sources.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00164 5th percentileScored 2026-11-07
Fix Fixed Raspberry Pi 5 and Compute Module 5 (Raspberry Pi): 28.22-1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Raspberry Pi | Raspberry Pi 5 and Compute Module 5 | before 28.22-1 | 28.22-1 | Patch available | CNA |
- Raspberry Pi 5 and Compute Module 5 VendorRaspberry Pi Affected before 28.22-1 Fixed in 28.22-1 Patch available CNA
Remediation
- Fix · CNA Raspberry Pi 5 and Compute Module 5 (Raspberry Pi) Fixed in 28.22-1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-13199
- 2026-10-03 Alias added: GHSA-fghc-hpwq-xm37
References
More Raspberry Pi vulnerabilities
- TI-2021-16307 Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. CVSS 3.1CRITICAL 9.8
- TI-2018-12841 The ARM-based hardware debugging feature on Raspberry Pi 3 module B+ and possibly other… CVSS 3.0CRITICAL 9.8
- TI-2021-16144 Raspberry Pi 3 B+ and 4 B devices through 2021-08-09, in certain specific use cases in… CVSS 3.1MEDIUM 5.9
Sources
- CVE-2026-13199 · CVE Program
- CVE-2026-13199 · NVD
- FIRST EPSS
- GHSA-fghc-hpwq-xm37 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences