> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# EVE-OS 13.4.4 LTS Release Notes

> Article Published Date: 11/3/2026. The latest 13.4.4 LTS version is https://github.com/lf-edge/eve/releases/tag/13.4.4-lts

Article Published Date: 11/3/2026

The latest 13.4.4 LTS version is [https://github.com/lf-edge/eve/releases/tag/13.4.4-lts](https://github.com/lf-edge/eve/releases/tag/13.4.4-lts)

For a change log between 13.4.3-lts and 13.4.4-lts, see: [https://github.com/lf-edge/eve/compare/13.4.3-lts...13.4.4-lts](https://github.com/lf-edge/eve/compare/13.4.3-lts...13.4.4-lts)

## Enhancements

### Security

EVE-OS 13.4.4 LTS is a kernel security hotfix. One CVE (CVE-2026-99999) is not yet resolved on the amd64-generic kernel; see the note on that item below.

* **CVE-2026-98432** fixes a use-after-free in TCP/IPv4 IP options handling that could allow a local attacker to crash the kernel or escalate privileges on an edge node. This fix applies to all platforms.
* **CVE-2026-99999 ("PwnEscape")** fixes an out-of-bounds write caused by an unvalidated IPv4 checksum offset that could allow a local attacker to corrupt kernel memory. This fix applies to arm64 and riscv64. **The amd64-generic kernel does not yet include this fix; a follow-up release will address it.**
* **CVE-2026-46113** fixes a use-after-free in KVM x86 shadow paging triggered by an unexpected guest frame number that could allow a guest VM to crash the host kernel or escalate privileges. This fix applies to amd64 only and is not relevant to arm64 or riscv64.
* **CVE-2026-53359** fixes a use-after-free in KVM x86 shadow paging triggered by an unexpected paging role, with the same exploit potential as CVE-2026-46113. This fix applies to amd64 only.
* **CVE-2026-31431** fixes an improper write to the page cache through the AEAD splicing path in the kernel cryptographic API that could allow a local attacker to corrupt memory or escalate privileges. This fix applies to all platforms.

### Linux OS and kernel updates

* On riscv64, the default kernel configuration now enables memory and cpuset cgroups and Pressure Stall Information (PSI) monitoring, extending resource isolation and pressure visibility to riscv64-based edge nodes.
* On amd64 and arm64 kernels, the configuration now enables `CONFIG_CGROUP_BPF` and updates module compression settings. `INTEL_PCH_THERMAL` has been disabled as it is not used in EVE-OS deployments.
* Device support has been added for Siemens IPC hardware, Dell Precision 5860, NUC thermal sensors, EDAC/ECC memory error detection, the Hailo AI accelerator driver (version 4.21), and the FR201 TPM device tree. Edge nodes using these hardware components can now be onboarded without additional driver configuration.