• State TI Thinks Resolved
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 99 subscribers
  • Views 124 views
  • Users 0 members are here
Support feedback
Options
Options
Related

AM625: ti-linux-kernel 6.18 outstanding CVE vulnerabilities

Bryan Green
Prodigy 180 points

Part Number: AM625

Hi,

I am using the latest yocto-based SDK release to build images for am625.

I'm building the 6.18 ti-linux-kernel, and using meta-cyclonedx to produce sbom and vex files for import to DependencyTrack.

based on the sbom and vex produced by the build, DependencyTrack is reporting 326 CVE vulnerabilities.

Is TI doing anything to address these CVEs, or do you have a recommendation for addressing them?

Thanks,

Bryan

 

  • 0
    TI__Mastermind 30876 points

    Hi Bryan,

    These CVEs are usually related to different components in the kernel that TI doesn't own. We rely on the community to implement fixes and upstream them. If they are picked up by the LTS stable branch, we will pull them into our next release. 

    If you feel the CVE is on a component that TI directly owns, either directly related to our SoCs or the contributions we have made to support them, we'd be happy to look at it. You can ask about it here, or you can contact our PSIRT team if you feel it is necessary.

    Thanks,

    Ron

  • 0 in reply to RonB
    Prodigy 180 points

    The yocto kernel for wrynose (linux-yocto_6.18.bb) is currently at 6.18.24, which addresses a number of these CVEs.  The latest TI kernel (linux-ti-staging_6.18.bb) is still only at 6.18.15.  Will this be updated soon to 6.18.24?

  • 0 in reply to Bryan Green
    TI__Mastermind 30876 points

    Hi Bryan,

    I'm sorry I didn't respond earlier. This is a very good question. The short answer is absolutely. SDK 12.x is our current active develelopment branch throughout this year (2026). 12.0, which was the first release to use the v6.18 kernel, is the first release for this stream. We have two more releases planned this year that will pull in the latest stable branches from Mainline and likely the fixes for these CVEs if they are available from the community. The next release, v12.1 of the SDK, is planned for this Summer, likely in the July timeframe. 

    If you'd like to grab one of our CI/CD snapshots and check it for progress, you can see those here:

    https://software-dl.ti.com/cicd-report/linux/index.html?section=platform&platform=am62xx

    I hope this helps,

    Ron