EVE-OS 16.0.2 LTS Release Notes

Updated

Article Published Date: 9/14/2026 

The latest 16.0.2 LTS version is https://github.com/lf-edge/eve/releases/tag/16.0.2-lts 

For a change log between 16.0.1-lts and 16.0.2-lts, see: https://github.com/lf-edge/eve/compare/16.0.1-lts...16.0.2-lts 

 

Enhancements

Linux OS and kernel updates

  • The amd64 generic kernel moves to 6.12.96, which includes a fix for ACPI watchdog registers that fall inside ACPI NVS memory. Edge nodes that rely on the hardware watchdog for automatic recovery now initialize it correctly.
  • The amd64 real-time kernel moves to 6.1.111 and enables the Intel Volume Management Device (VMD) driver, adding support for NVMe drives behind Intel VMD controllers. It also enables Pressure Stall Information (PSI), which gives EVE-OS more accurate visibility into CPU, memory, and I/O contention.
  • Kernel pins that no supported architecture or platform combination can select have been removed, so the kernel actually built for each platform is now unambiguous.

Security

  • EVE-OS now validates that every SHA-256 digest it receives is a well formed hexadecimal before using it as a file path. Malformed or hostile digests in a content tree or datastore configuration can no longer be used to write outside the intended directory.
  • The volumemgr service now fails a content tree with a clear error when it contains a malformed SHA-256 digest, instead of continuing with an invalid reference.
  • Cloud-init file writes are now checked against a stricter containment rule, closing a path-traversal gap in cloud config handling.
  • EVE-OS automatically trusts the root certificate authorities installed in /etc/ssl/certs/. Administrators no longer need a separate extra certificate file to reach a controller or datastore that is fronted by an enterprise or private certificate authority.
  • The cipher service now reports a failed decryption as an explicit failure, so credential and secret unwrapping problems surface to Edge Infrastructure Services instead of failing silently.
  • EVE-OS reports its origin version (the version installed before the current update) to Edge Infrastructure Services as part of remote attestation. Edge Infrastructure Services uses this to correctly predict the post-update PCR 14 value, which reduces false attestation failures after an EVE-OS upgrade.
  • The virtual TPM service now mounts /config, allowing it to detect the SHA-256 PCR bank and use the correct measurement algorithm.

Console and access control

  • Setting the debug.enable.console configuration property to false now disables serial consoles at runtime, not just VGA and USB consoles. Previously, a getty process on a serial console declared in the kernel command line restarted itself after EVE-OS terminated it, leaving the serial console reachable on hardware that exposes one.
  • EVE-OS preserves newlines between multiple SSH keys supplied in the bootstrap authorized_keys configuration, so all provided keys are honored rather than only the first.
  • When the global configuration is not yet available, EVE-OS falls back to the authorized_keys file on the config partition. This keeps administrative SSH access working on an edge device that has not yet received configuration.

Hardware and device assignment

  • EVE-OS now resolves an interface name to its deepest PCI address, producing accurate device identification on adapters that present nested PCI devices.
  • Physical ports that are currently in use are kept out of pciback, preventing EVE-OS from detaching an adapter that active networking depends on.
  • The domainmgr service no longer refuses an adapter when hardware reporting produces only a warning, so usable devices are no longer withheld from edge containers because of a non-fatal condition.
  • I/O bundle errors are now reported per assignment group, making it clear which group of devices is affected when passthrough configuration is rejected.
  • A false USB I/O bundle collision has been fixed. Devices that do not actually conflict are no longer reported as overlapping.
  • Assignable adapter reporting now omits empty fields, preventing oversized messages from overflowing internal EVE-OS message queues on edge nodes with large device inventories.
  • Single Root I/O Virtualization (SR-IOV) virtual function discovery is more reliable. EVE-OS parses virtual function interface names correctly and polls for the virtual function directly, resolving intermittent failures when bringing up SR-IOV interfaces.

Datastores and image downloads

  • The download service supports HTTP and HTTPS Basic, Bearer, and NTLM authentication. Administrators can now pull edge container images and other artifacts from datastores that require an authenticated HTTP endpoint.
  • The download service uses datastore custom certificates when resolving OCI references, so a private registry with its own certificate authority works consistently across resolution and download.
  • Blob ingestion into the content store is now idempotent when a previously verified file is missing, allowing a retried download to complete instead of failing permanently.
  • The local profile server serves ZFS volume-backed patch envelope artifacts with the correct size, so edge containers retrieve complete patch envelope content on ZFS-based edge nodes.

Observability

  • The logging service captures cgo aborts and full tracebacks, giving support engineers the diagnostic detail needed to investigate low-level crashes.
  • ANSI escape code stripping in logs has been fixed, so console output from edge containers is readable in collected logs.
  • Log cleaning no longer removes non-standard fields, preserving application-specific log metadata that previously was discarded.
  • Logging for ZEDEDA Edge Kubernetes Service workloads has been fixed for both virtual machine instances and shim or container instances, so Kubernetes-managed edge container logs reach Edge Infrastructure Services reliably.
  • Noisy periodic logging from external boot image checks has been removed, and unused outdated external boot image containers have been dropped.
  • Disk metrics collection reports progress while walking the filesystem, and uses a whole-filesystem query for total and available space. Space reporting on edge nodes with very large or deeply nested filesystems is now both faster and more accurate.
  • Logging space is now reserved in bytes rather than megabytes, correcting the amount of storage actually set aside for logs.
  • Growth of per-URL counters in download metrics is now bounded, preventing unbounded memory use on edge nodes that download from many distinct URLs.
  • The diagnostic collection tool uses shared token handling, making credential detection consistent with the rest of EVE-OS.

Performance

  • EVE-OS no longer modulates disk reads to drive a disk activity LED. This legacy mechanism performed continuous read operations purely to produce a blink pattern. Removing it eliminates unnecessary I/O against the storage device on every edge node.
  • ZFS namespace enumeration is now serialized, removing a source of contention and instability during ZFS storage operations.

Configuration and packaging

  • EVE-OS honors the hostname declared in a cloud config, so an edge container receives the hostname the administrator specified.
  • The zedagent service re-reads configuration after maintenance mode ends, so configuration changes made while an edge node was in maintenance mode take effect without a further update.
  • Published image tags no longer duplicate the platform variant, making downloadable image names predictable.
  • Large evaluation and source artifacts are compressed with zstd, reducing download size and time for EVE-OS evaluation images.

Resolved Issues & Fixes

  • Fixed a crash in the TPM recovery package caused by a duplicate protocol buffer registry entry, which could prevent TPM recovery from running.
  • Fixed a memory exhaustion condition in the USB manager where an assignment group that referenced itself as its own parent caused unbounded memory growth and terminated the EVE-OS control plane.
  • Fixed file permissions that were declared as decimal rather than octal values, including the permissions on the wireless LAN runtime directory. Affected directories and files are now created with the intended access mode.
  • Fixed a failure to fall back gracefully when the system certificate pool cannot be loaded, so a certificate store problem no longer breaks controller connectivity outright.
  • Fixed a dropped HTTP port in the GRUB network boot patch, so network boot from a server on a non-default HTTP port now works.
  • Fixed a stale package reference so the correct dom0-ztools package version is included in the image.
  • Removed an invalid scheduler argument from the debug exec path in the container runtime integration, which caused debug commands against edge containers to fail.
  • Aligned the Rust toolchain used by the installer package with the rest of the branch, resolving installer build inconsistencies.
Was this article helpful?
0 out of 0 found this helpful