Kernel

The Linux kernel isn’t exciting, and that’s what we love about it. 7.0 is a release much like any other, and Linus just doesn't have enough toes to count above 19.

At Pengutronix, we have contributed a total of 21 patches to this release, not counting the merges performed by our subsystem maintainers.

Michael Tretter and Stefan Kerkmann have simplified error handling in the generic GPIO library and the BD71815 power-supply driver. Marc Kleine-Budde and Michael Tretter have improved tracking of controller error counters in the SJA1000 CAN controller driver. Marco Felsch has added support for additional frequencies needed by some parallel panels to the Fractional-N frequency synthesizer of the i.MX93 SoC. Fabian Pflug has mainlined support for the FRDM i.MX 93 development board based on previous work from the board’s manufacturer NXP. Sascha Hauer, Michael Tretter, Steffen Trumtrar, Fabian Pflug, and Oleksij Rempel have improved devicetree bindings documentation in areas such as System on Chip Alsa Audio (ASoC), analog video decoders, LED Matrices, and analog-to-digital converters.

Marc resolved an issue in the teardown of the i.MX Low Power Serial Peripheral Interface (LPSPI) controller driver that could lead to a NULL pointer dereference due to use after free. On the CAN side, he resolved an issue with GS and candleLight compatible CAN interfaces loosing bitrate configuration on ifdown, and added error handling lost during refactoring to the CAN Netlink support.

Michael Grzeschik has addressed a regression in the bluetooth subsystem where connecting to multiple bluetooth devices at the same time had become unreliable.

Oleksij has resolved a collection of issues in the driver for the LAN78xx family of USB-Ethernet adapters:

• A warning during USB device disconnect
• Configuration of wrongful Latency Tolerance Messaging (LTM), a SuperSpeed/USB 3.0 feature on High-Speed/USB 2.0 devices
• Inaccurate byte transfer statistics for underlong ethernet frames
• Better handling of corrupted IP packets

OP-TEE

Since my last blog entry, Pengutronix has contributed 14 Patches to OP-TEE OS, hardening the protection of applications in the ARM TrustZone.

Ten of those belong to a big series hardening the TZASC configuration on i.MX SoCs by our colleague Marco Felsch. The TZASC is the “TrustZone Address Space Controller”, a part of the ARM SoC, that protects sensitive memory regions from access outside the secure world. This strengthens the protection of secrets stored in OP-TEE on platforms such as i.MX6 and i.MX8M.

Another patch by Marco fixes the default OP-TEE memory configuration for the i.MX8MP-EVK platform. The fix is required because this platform has 6GiB of DRAM and OP-TEE is placed at the end of the DRAM.

Well executed random number generation is important in the type of cryptographic operations often delegated to the trusted OS. Our colleague Philipp Zabel has contributed three patches correcting and improving the driver for the i.MX 6ULL Hardware Random Number Generator.

For a German-language overview of Verified Boot, the ARM TrustZone, and OP-TEE, Marco has just held a presentation at Chemnitzer Linux Tage 2026, and a recording can be found online: OP-TEE: Offene Sicherheit für ARM – Ein Einblick.

candleLight firmware

The candleLight is an open hardware USB-CAN adapter. At Pengutronix, we make use of Linux Automation’s variant, the candleLightFD, which is just one of the devices supported by the open candleLight firmware.

Our CAN expert Marc Kleine-Budde and hardware expert Jonas Martin have contributed 74 improvements to it since February. This includes build system improvements and cleanups but also support for new models and new hardware features such as multi-CAN boards.

YOCTO/Openembedded

At Pengutronix, we work quite a bit with YOCTO BSPs, so it is no surprise we send patches to its build system Openembedded every once in a while. This time it’s been resolving an issue where devtool would destroy git worktrees, support for OpenSSL config snippets, whitespace fixes, support for OpenSSL PKCS#11 providers (the non-deprecated OpenSSL extension API), and provider pem-files in signing.bbclass.

Barebox

We’ve added about 200 changes to barebox and our maintainer Sascha Hauer released v2026.02 and v2026.03. These include new board support, better NFS handling, loading barebox proper as an ELF image and more.

A severe vulnerability was discovered in both barebox’ and u-boot’s handling of signed FIT images. The hashed-nodes property of the signature node, which defines which nodes are subject to verification, was not itself covered by the signature. This allowed arbitrary untrusted images to be booted, effectively circumenventing secure boot.

To address this issue, we have released v2026.03.1 and v2025.09.3. We are asking users relying on FIT images in their secure boot chain in u-boot or barebox to update to fixed versions and have been working on coordinating with downstreams and customers to improve awareness and ensure timely mitigation.

You can find more details in the shared U-Boot/Barebox advisory by our colleague Ahmad Fatoum.

ptxdist

ptxdist 2026.03.0 and 2026.04.0 have been released. Of the about 100 recent changes, about a third where contributed by the community.

Labgrid

16 pull requests where merged on our embedded testing system labgrid, enabling broader hardware support, improved stability, and new features.

RAUC

RAUC hasn’t seen any community contributions recently, but 57 commits introduced by us at Pengutronix. Besides plenty of smaller improvements and documentation, Jan Lübbe has provided major contributions towards the Update Server Concept. This introduces a preview of the update polling feature for a new, simpler automated way for RAUC-enabled embedded systems to stay up to date with an update server that may either serve updates statically, or employ server-side scripting to control which device to update under which conditions.

Wider Ecosystem

Not all Open Source contributions are code. Our colleague Jan Lübbe has discovered a wider-than-known impact of an OpenSSL vulnerability and disclosed his findings. Jonas Rebmann resolved some inconsistencies in systemd documentation.