EVE-OS 17.0.1 LTS Release Notes

Article Published Date: 11/9/2026

The latest 17.0 LTS version is https://github.com/lf-edge/eve/releases/tag/17.0.1-lts

For a change log between 17.0.0-lts and 17.0.1-lts, see: https://github.com/lf-edge/eve/compare/17.0.0-lts...17.0.1-lts

Enhancements

Linux OS and kernel updates

  • Updated the 17.0 kernels to the latest eve-kernel branch heads, so all supported platforms receive the current upstream stable fixes.
  • Upgraded the amd64 kernel from Linux 6.12.49 to 6.12.96, which brings in KVM fixes and other upstream stable fixes.
  • Enabled Pressure Stall Information (PSI) on NVIDIA Jetson (JP6 and JP7) kernels, which improves resource pressure visibility.
  • Enabled the memory and cpuset cgroups and PSI in the riscv64 kernel configuration.
  • Updated Intel and AMD CPU microcode.

Security

  • Fixed CVE-2026-98432, a TCP/IPv4 use-after-free of IP options, on all kernels.
  • Fixed CVE-2026-99999, an IPv4 out-of-bounds write caused by an unvalidated checksum_start value, on all kernels.
  • Fixed CVE-2026-46113 and CVE-2026-53359, two KVM x86 shadow paging use-after-free issues, on the amd64 kernel.
  • Confirmed that every 17.0 kernel now includes the fix for CVE-2026-31431 (AF_ALG AEAD splice write to the page cache).
  • Hardened path handling in image verification, cloud-config file writes, and EdgeView to prevent path traversal and argument injection attacks.
  • Required a proxy-auth token, TLS, and a destination policy on the management proxy listener used by EVE-k.
  • Bounded HTTP response reads and error strings to protect edge nodes from resource exhaustion.
  • Hardened virtual TPM state handling and migrated legacy encryption.
  • Hardened 802.1X (PNAC) re-authentication and removal handling.
  • Surfaced how the vault was unlocked and reported the key derivation method, which improves auditability of edge node encryption.
  • Updated the CA certificate bundle to stop trusting the compromised eMudhra certificate authorities.

Networking

  • Made Local network instances resilient to uplink port flapping.
  • Added a configurable DPC test-fail interval and lowered the minimum test interval, which gives administrators finer control over connectivity checks.
  • Improved tracking of network interface and bridge identity so that interface changes are handled reliably.
  • Fixed reporting of application IP addresses and flows.

Hardware and device support

  • Added the ability to change an adapter assignment with an application restart instead of a purge.
  • Added support for disabling the console at runtime.
  • Reported USB-attached UARTs as COM ports.
  • Improved iGPU passthrough by placing guest stolen memory at the host base and always detaching the host framebuffer for an assigned iGPU.
  • Matched device ports by PCI address instead of interface name alone, and resolved interface names to the deepest PCI address.
  • Fixed the CDI file for NVIDIA Jetson JP7 and the udev rules for NVIDIA devices.

EVE-k and clustering

  • Added support for opting in to native Kubernetes orchestration on an edge node cluster.
  • Allowed a healthy peer node to act for a downed node's designated application.
  • Surfaced insufficient disk and memory conditions for Longhorn, and reported storage readiness accurately.
  • Reduced idle logging in the CSI handler status path.
  • Accepted a cluster PVC for volumes instead of downloading the source again.
  • Used a stable latest tag for the external boot image in VMIRSes.

Observability

  • Reported the provisioned size (volsize) of ZFS zvol volumes in volume metrics.
  • Captured cgo aborts and full tracebacks in logs.
  • Reduced log noise by no longer logging routine QMP events at warning level.
  • Honored the hostname declared in an application instance cloud-init configuration.

Resolved Issues and Bug Fixes

  • Fixed a vTPM issue so that it detects the SHA256 PCR bank.
  • Fixed an issue where failed volume deletions leaked volumes. EVE-OS now retries them.
  • Fixed an out-of-memory condition in the pillar service caused by the USB manager.
  • Fixed an issue where work was lost when the volume manager worker pool was saturated.
  • Fixed a node reboot that occurred when an I/O bundle did not belong to the edge node.
  • Fixed a reboot loop and several out-of-range panics related to PAC results.
  • Fixed a zedrouter crash that occurred when a network instance was deleted.
  • Fixed a panic caused by concurrent ZFS namespace enumeration.
  • Fixed a watchdog reset caused by the disk metrics collection.
  • Fixed a proto registry panic in the TPM recovery package.
  • Fixed goroutine leaks in the zedUpload and nettrace libraries.
  • Fixed downloads aborting when the declared size is unknown, and downloads hanging on a refused request.
  • Fixed unbounded growth of download metrics counters.
  • Fixed newlog space reservation so it uses bytes instead of megabytes.
  • Fixed an issue where the configuration was not re-read after a maintenance mode change or clear.
  • Fixed bootstrap SSH authorized keys losing newlines between entries.
  • Fixed the installer post-install verification stage.
  • Fixed an issue where escrow data could be lost during attestation.
  • Fixed a failed decryption being reported as a success.
  • Fixed file permission gaps in the vault and attestation components.
  • Fixed patch envelope artifacts backed by zvols being served with the wrong size.
  • Fixed USB passthrough behavior when device models change at runtime.
  • Fixed PCI address extraction for USB devices behind PCIe bridges.
  • Fixed a graceful stop wait that could run without a bound, and made the force flag work when stopping a KVM domain.
  • Fixed two adapter assignment regressions introduced by the PCI port matching change.
  • Fixed the portmap overlap check so it ignores Switch network instances.
  • Fixed a case where a VMIRS remained stranded with zero replicas.
  • Fixed EVE-k issues with stale VMIRS generations after a purge, stuck kubelet volume mounts, Multus NAD apply ordering, the Longhorn disk reservation, and the Longhorn disk path readiness gate.
  • Fixed EVE-k issues with the SR-IOV device plugin gate, CDI HTTP DataVolume imports through the proxy, and PVC upload cancellation and failure reporting.
  • Fixed EVE-k container volume user name resolution, and added diagnostics for stuck application bring-up.
  • Fixed stale state after a cluster DNID reassignment, and cleared the retired pod subnet when a node joins.
  • Fixed controller pod recycling after a single-node to cluster datastore migration.
  • Fixed containerd CPU confinement so it respects the configured maximum vCPU count.
  • Fixed the debug container exec scheduler and the debug package device model fields.
  • Fixed decimal literals used as file modes in pillar.
  • Fixed installer media sharing disk and ESP GUIDs by giving each installer its own.
Was this article helpful?
0 out of 0 found this helpful