EVE-OS 13.4.4 LTS Release Notes

Article Published Date: 11/3/2026

The latest 13.4.4 LTS version is https://github.com/lf-edge/eve/releases/tag/13.4.4-lts

For a change log between 13.4.3-lts and 13.4.4-lts, see: https://github.com/lf-edge/eve/compare/13.4.3-lts…13.4.4-lts

Enhancements

Security

EVE-OS 13.4.4 LTS is a kernel security hotfix. One CVE (CVE-2026-99999) is not yet resolved on the amd64-generic kernel; see the note on that item below.

• CVE-2026-98432 fixes a use-after-free in TCP/IPv4 IP options handling that could allow a local attacker to crash the kernel or escalate privileges on an edge node. This fix applies to all platforms.
• CVE-2026-99999 (“PwnEscape”) fixes an out-of-bounds write caused by an unvalidated IPv4 checksum offset that could allow a local attacker to corrupt kernel memory. This fix applies to arm64 and riscv64. The amd64-generic kernel does not yet include this fix; a follow-up release will address it.
• CVE-2026-46113 fixes a use-after-free in KVM x86 shadow paging triggered by an unexpected guest frame number that could allow a guest VM to crash the host kernel or escalate privileges. This fix applies to amd64 only and is not relevant to arm64 or riscv64.
• CVE-2026-53359 fixes a use-after-free in KVM x86 shadow paging triggered by an unexpected paging role, with the same exploit potential as CVE-2026-46113. This fix applies to amd64 only.
• CVE-2026-31431 fixes an improper write to the page cache through the AEAD splicing path in the kernel cryptographic API that could allow a local attacker to corrupt memory or escalate privileges. This fix applies to all platforms.

Linux OS and kernel updates

• On riscv64, the default kernel configuration now enables memory and cpuset cgroups and Pressure Stall Information (PSI) monitoring, extending resource isolation and pressure visibility to riscv64-based edge nodes.
• On amd64 and arm64 kernels, the configuration now enables CONFIG_CGROUP_BPF and updates module compression settings. INTEL_PCH_THERMAL has been disabled as it is not used in EVE-OS deployments.
• Device support has been added for Siemens IPC hardware, Dell Precision 5860, NUC thermal sensors, EDAC/ECC memory error detection, the Hailo AI accelerator driver (version 4.21), and the FR201 TPM device tree. Edge nodes using these hardware components can now be onboarded without additional driver configuration.