Article Published Date: 11/3/2026
The latest 16.0.3 LTS version is https://github.com/lf-edge/eve/releases/tag/16.0.3-lts
For a change log between 16.0.2-lts and 16.0.3-lts, see: https://github.com/lf-edge/eve/compare/16.0.2-lts…16.0.3-lts
Enhancements
Security
EVE-OS 16.0.3 LTS is a kernel security hotfix. All 16.0 kernels are now fully patched for every CVE in this advisory.
- CVE-2026-98432 fixes a use-after-free in TCP/IPv4 IP options handling that could allow a local attacker to crash the kernel or escalate privileges on an edge node. This fix applies to all platforms.
- CVE-2026-99999 (“PwnEscape”) fixes an out-of-bounds write caused by an unvalidated IPv4 checksum offset that could allow a local attacker to corrupt kernel memory. This fix applies to all platforms.
- CVE-2026-46113 fixes a use-after-free in KVM x86 shadow paging triggered by an unexpected guest frame number that could allow a guest VM to crash the host kernel or escalate privileges. This fix applies to amd64 only and was already present in the amd64 generic kernel; it is now also included in the amd64 evaluation (HWE) kernel.
- CVE-2026-53359 fixes a use-after-free in KVM x86 shadow paging triggered by an unexpected paging role, with the same exploit potential as CVE-2026-46113. This fix applies to amd64 only and is now included in the amd64 evaluation (HWE) kernel.
Linux OS and kernel updates
- On arm64 kernels, transparent huge pages now default to
madvise, which lets workloads that benefit from huge pages opt in explicitly while avoiding unexpected memory overhead for others. - On NVIDIA Jetson jp5 and jp6 kernels, Pressure Stall Information (PSI) monitoring is now enabled, giving EVE-OS more accurate visibility into CPU, memory, and I/O contention on Jetson-based edge nodes.
- On the amd64 evaluation (HWE) kernel, Xen hypervisor support (
CONFIG_XEN) has been removed, as it is not used in EVE-OS deployments. - On riscv64, the default kernel configuration now enables memory and cpuset cgroups and PSI, extending resource isolation and pressure monitoring to riscv64-based edge nodes.