> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# EVE-OS 16.0.3 LTS Release Notes

> Article Published Date: 11/3/2026. The latest 16.0.3 LTS version is https://github.com/lf-edge/eve/releases/tag/16.0.3-lts

Article Published Date: 11/3/2026

The latest 16.0.3 LTS version is [https://github.com/lf-edge/eve/releases/tag/16.0.3-lts](https://github.com/lf-edge/eve/releases/tag/16.0.3-lts)

For a change log between 16.0.2-lts and 16.0.3-lts, see: [https://github.com/lf-edge/eve/compare/16.0.2-lts...16.0.3-lts](https://github.com/lf-edge/eve/compare/16.0.2-lts...16.0.3-lts)

## Enhancements

### Security

EVE-OS 16.0.3 LTS is a kernel security hotfix. All 16.0 kernels are now fully patched for every CVE in this advisory.

* **CVE-2026-98432** fixes a use-after-free in TCP/IPv4 IP options handling that could allow a local attacker to crash the kernel or escalate privileges on an edge node. This fix applies to all platforms.
* **CVE-2026-99999 ("PwnEscape")** fixes an out-of-bounds write caused by an unvalidated IPv4 checksum offset that could allow a local attacker to corrupt kernel memory. This fix applies to all platforms.
* **CVE-2026-46113** fixes a use-after-free in KVM x86 shadow paging triggered by an unexpected guest frame number that could allow a guest VM to crash the host kernel or escalate privileges. This fix applies to amd64 only and was already present in the amd64 generic kernel; it is now also included in the amd64 evaluation (HWE) kernel.
* **CVE-2026-53359** fixes a use-after-free in KVM x86 shadow paging triggered by an unexpected paging role, with the same exploit potential as CVE-2026-46113. This fix applies to amd64 only and is now included in the amd64 evaluation (HWE) kernel.

### Linux OS and kernel updates

* On arm64 kernels, transparent huge pages now default to `madvise`, which lets workloads that benefit from huge pages opt in explicitly while avoiding unexpected memory overhead for others.
* On NVIDIA Jetson jp5 and jp6 kernels, Pressure Stall Information (PSI) monitoring is now enabled, giving EVE-OS more accurate visibility into CPU, memory, and I/O contention on Jetson-based edge nodes.
* On the amd64 evaluation (HWE) kernel, Xen hypervisor support (`CONFIG_XEN`) has been removed, as it is not used in EVE-OS deployments.
* On riscv64, the default kernel configuration now enables memory and cpuset cgroups and PSI, extending resource isolation and pressure monitoring to riscv64-based edge nodes.