Armbian backports 100+ kernel CVE fixes for 6.1 and 6.12 LTS, adds RK3576 and EM3588 boards

The Armbian project has published its weekly development summary, dominated by a large-scale security backporting initiative for Linux kernels 6.1 and 6.12 LTS. More than one hundred reviewed CVE patch sets have been applied across networking, filesystem, virtualization, graphics, and core kernel subsystems, supported by a new fasttrack CI pipeline with per-series sharding and build-time verification. The project also introduced a new per-cluster cpufreq and tuning-profile framework that replaces cpufrequtils with image-level profiles exposed through configng.

Hardware enablement expanded with several new boards including the Seeed reComputer Industrial RK3576, Boardcon EM3588, CZ.NIC Turris Omnia (Marvell Armada 385), Hardkernel ODROID-U2/U3/X2 (Exynos4412), and DshanPi A1 CM5. Rockchip vendor kernels gained NPU support for Orange Pi CM5, ArmSoM CM5-IO, and Rock 4D, plus CAN-FD support for RK3576. MediaTek Filogic boards migrated to kernel 6.18 LTS with U-Boot 2026.10, while handheld devices Anbernic RG DS and RG Vita Pro received charge-screen and USB fixes.

CVE backporting pipeline and platform changes

• CVE backport scope: Over 100 reviewed backport sets landed for kernels 6.1 and 6.12 LTS, covering mac80211/cfg80211, Bluetooth, netfilter, mlx5, stmmac, btrfs, f2fs, ext4, SMB client/ksmbd, KVM SVM/SEV, vhost, virtio, amdgpu, i915, vc4, msm, bpf, mm, and io_uring.
• Fasttrack CI infrastructure: New pipeline implements per-series sharding, build-time header-change verification, compilation of .c files including changed headers, triage records for not-affected verdicts, and tagged releases on each patch set change.
• CPU tuning framework: Per-cluster cpufreq and tuning-profile system replaces cpufrequtils with image-level profiles, configurable through configng, with TUNING_PROFILE documentation added to the build framework.
• Rockchip NPU and CAN-FD enablement: Vendor kernels now support NPU on Orange Pi CM5, ArmSoM CM5-IO, and Rock 4D; RK3576 gains CAN-FD support alongside the new Seeed reComputer Industrial board.
• Wireless and handheld fixes: UWE5622 driver receives fixes for memory corruption, teardown, and TCP ACK stalls; Anbernic RG DS and RG Vita Pro get charge-screen behavior and sgm41542 USB host/charging fixes.

Why it matters

Armbian's systematic CVE backporting program addresses a critical gap in long-term security maintenance for ARM and RISC-V single-board computers, which often rely on vendor kernels that lag behind upstream security fixes. The new CI infrastructure and triage methodology could serve as a model for other embedded Linux distributions struggling with sustainable LTS kernel maintenance. For industrial and edge deployments using Rockchip RK3576 platforms or MediaTek Filogic networking hardware, the combined security, NPU acceleration, and CAN-FD support strengthens the viability of open-source embedded Linux in commercial applications.