Security¶
Learn whether a security advisory matters to your Raspberry Pi OS or Ubuntu installation, what to check, and how to verify an update. These guides explain the conditions behind a vulnerability rather than treating every CVE headline as an emergency for every Pi.
Start here¶
Read How to Read a CVE for the difference between a CVE identifier, a severity score, an affected package and a verified fix. You do not need to run exploit code to begin checking your system.
CVE explainers¶
CVE-2026-99999: Linux IPv4 checksum handling¶
Reviewed: 30 October 2026. Learn why an attack from an untrusted virtual machine is different from an ordinary Internet packet, and why the kernel package matters more than the board name.
The guide records separate Ubuntu, Debian and Raspberry Pi OS findings. It does not claim that every Pi is exploitable or that Raspberry Pi OS is confirmed fixed.
What each guide tells you¶
- What the affected component does, in plain language.
- Which access and configuration conditions matter.
- OS/package-specific findings, with a review date and official references.
- Read-only checks, then clearly separated administrative update steps.
- What was tested and what remains unknown.
Read the date before relying on a status. “Fixed” means a named vendor/package release includes a correction; it does not prove your device has installed and activated it. “Under investigation” or “not verified here” does not mean unaffected. These are dated explanations, not a live vulnerability scanner or a continuously monitored feed.
Protect a working Pi¶
For routine prevention, use the existing SSH and firewall hardening guide. For hardware-backed keys and boot integrity, start with the TPM security guide. Those practical guides remain in Tips; they are not prerequisites for every CVE article.
If you suspect an actual compromise, patching alone does not establish that the machine is clean. Seek incident-response advice appropriate to the system and preserve evidence before attempting an improvised cleanup.