Skip to content

DietPi

v10.4 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 4 known CVEs

Topics

shell debian dietpi lightweight nanopi odroid
+7 more
optimization orangepi pine64 radxa raspberrypi risc-v sbc

Affected surfaces

rce_ssrf breaking_upgrade

ReleasePort's take

Moderate signal
editorial:auto 9d

Dedicated Orange Pi 5B images are now available; Linux vulnerabilities CVE‑2026‑31431, CVE‑2026‑43284, and CVE‑2026‑43500 have been mitigated across all supported SBCs.

Why it matters: Mitigating three kernel CVEs (CVE‑2026‑31431, CVE‑2026‑43284, CVE‑2026‑43500) protects every supported single‑board computer from critical remote exploits.

Summary

AI summary

CVE-2026 kernel vulnerabilities mitigated and persistent log files moved from /var/tmp to /var/lib

Changes in this release

Security Medium

Mitigated Linux vulnerabilities CVE-2026-31431, CVE-2026-43284, and CVE-2026-43500 across all supported SBCs.

Mitigated Linux vulnerabilities CVE-2026-31431, CVE-2026-43284, and CVE-2026-43500 across all supported SBCs.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: low

Feature Medium

Dedicated images for Orange Pi 5B are provided now.

Dedicated images for Orange Pi 5B are provided now.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: high

Feature Medium

DietPi-Installer handles GRUB BIOS images with GPT partition table without dedicated BIOS boot partition gracefully.

DietPi-Installer handles GRUB BIOS images with GPT partition table without dedicated BIOS boot partition gracefully.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: high

Feature Medium

DietPi-Software pushes own up-to-date Unbound packages via APT server for all users.

DietPi-Software pushes own up-to-date Unbound packages via APT server for all users.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: high

Feature Medium

soju migrated to new official Codeberg repository; recommend updating with dietpi-software reinstall 213.

soju migrated to new official Codeberg repository; recommend updating with dietpi-software reinstall 213.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: low

Feature Medium

Java version bumped to 26 for 64-bit systems; Java 21 remains highest for ARMv7 due to architecture limitations.

Java version bumped to 26 for 64-bit systems; Java 21 remains highest for ARMv7 due to architecture limitations.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: low

Bugfix Medium

Resolved DietPi-Drive_Manager regression causing invalid /boot/firmware/cmdline.txt root entry on Raspberry Pi v10.3.

Resolved DietPi-Drive_Manager regression causing invalid /boot/firmware/cmdline.txt root entry on Raspberry Pi v10.3.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: high

Bugfix Medium

Fixed Docker installation regression in DietPi-Software v10.3 where --no-reload prevented docker.socket startup.

Fixed Docker installation regression in DietPi-Software v10.3 where --no-reload prevented docker.socket startup.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: high

Bugfix Medium

Persistent DietPi log files moved from /var/tmp/dietpi/logs to /var/lib/dietpi/logs.

Persistent DietPi log files moved from /var/tmp/dietpi/logs to /var/lib/dietpi/logs.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: low

Bugfix Medium

Network interface names for Ethernet ports on NanoPi R76S are now persistent on reboot.

Network interface names for Ethernet ports on NanoPi R76S are now persistent on reboot.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: low

Bugfix Medium

Home Assistant installation issue fixed by replacing runuser with setpriv --reset-env to ensure clean environment.

Home Assistant installation issue fixed by replacing runuser with setpriv --reset-env to ensure clean environment.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: low

Bugfix Medium

Synapse installation issue resolved by ensuring dependencies are installed as intended.

Synapse installation issue resolved by ensuring dependencies are installed as intended.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: low

Bugfix Medium

Immich and ownCloud Infinite Scale service start issues fixed by using test -e instead of touch for automount triggers.

Immich and ownCloud Infinite Scale service start issues fixed by using test -e instead of touch for automount triggers.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: low

Bugfix Medium

Prometheus Node Exporter issue on Raspberry Pi resolved; CPU temperature format corrected regardless of locale decimal separator.

Prometheus Node Exporter issue on Raspberry Pi resolved; CPU temperature format corrected regardless of locale decimal separator.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: low

Refactor Medium

Merged linux-dtb-* package into linux-image-* for Allwinner/Amlogic/Rockchip SBCs.

Merged linux-dtb-* package into linux-image-* for Allwinner/Amlogic/Rockchip SBCs.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: high

Full changelog

New images

  • Orange Pi 5B | Dedicated images for the Orange Pi 5B are provided now. Previously, the Orange Pi 5 images could be used, but it was required to change the used device tree manually to enable board-specific features like WiFi.

Enhancements

  • General | Persistent DietPi log files have been moved from /var/tmp/dietpi/logs to /var/lib/dietpi/logs. Since Debian Trixie, content of /var/tmp older than 30 days is cleared, which renders this directory inappropriate for any persistent files. And to be honest: it was never meant to be used the way we did it. The DietPi update will copy files over, but it cannot remove /var/tmp/dietpi, since the v10.3 updater itself is logging to it while it runs. On Debian Trixie, systemd-tmpfiles will remove it 30 days later. On Debian Bookworm, you may remove it manually, but the size is small.
  • Linux security | The two recent major Linux vulnerabilities CVE-2026-31431 aka "Copy Fail", CVE-2026-43284 and CVE-2026-43500 aka "Dirty Frag", have been mitigated across all supported SBCs: Debian and Raspberry Pi Ltd pushed kernel updates containing the fix, and we did so for all kernel packages distributed with our APT repository. The DietPi update will upgrade kernel packages implicitly. Else please upgrade it yourself, or prevent the affected kernel modules from being loaded, as can be read here: https://github.com/MichaIng/DietPi/issues/8122
  • Allwinner/Amlogic/Rockchip SBCs | We merged the linux-dtb-* package into the linux-image-* package. You might have recognized that an apt upgrade held back two packages, and an apt full-upgrade removed the linux-dtb-* package while upgrading linux-image-*, which is hence intended. Along with some other changes in our Armbian build system fork, this makes switching between kernel branches easier and more robust, and allows to keep multiple kernel branches installed concurrently safe. The DietPi update will imply the kernel upgrade, if not done yet, unless it was explicitly marked hold by the admin.
  • NanoPi R76S | The network interface names for the two Ethernet ports are now persistent on reboot. They previously could randomly swap on reboot. Many thanks to @oxoocoffee for reporting this: https://github.com/MichaIng/DietPi/issues/7844
  • DietPi-Installer | Cases of GRUB BIOS images with GPT partition table, but without dedicated BIOS boot partition, are now handled gracefully. GRUB throws warnings in those cases, and by default fails, as flashing the bootloader to the gap between GPT header and first partition is considered unreliable. But obviously, the image worked that way before, and Debian's grub-pc package postinst script explicitly ignores the warnings, calling grub-install with the --force flag. The dietpi-installer will now do the same, if this exact case is detected: GPT partition table, no EFI partition => GRUB BIOS needed, but no BIOS boot partition either. Many thanks to @mews-se for reporting a related case of a VPS image: https://github.com/MichaIng/DietPi/issues/8030
  • DietPi-Software | soju: We migrated to the new official soju repository at Codeberg, after the its GitHub repository got archived. This implies some new releases, hence we recommend to update your soju instance with a dietpi-software reinstall 213.
  • DietPi-Software | Unbound: We push our own up-to-date Unbound packages via our APT server now. This means, that also users who did not install Unbound via dietpi-software get our default config and reduced Debian-only content. Please let us know if you face any issues.
  • DietPi-Software | Java: The version has been bumped to Java 26 for 64-bit systems. On ARMv7, Java 21 is the highest practically usable one: from Java 22 on, ARMv7 support for the HotSpot JVM is broken, hence the extremely slow Zero JVM is used. This causes e.g. Airsonic on the Odroid XU4 to require 1.5 hours to start. This limits the versions of some Java applications on ARMv7, like Minecraft to max v1.21.x. This bug is unlikely to be ever resolved, due to decreasing relevancy of 32-bit ARM architectures. The upstream bug is tracked here: https://bugs.openjdk.org/browse/JDK-8321125

Bug fixes

  • DietPi-Drive_Manager | Resolved a v10.3 regression where moving the rootfs on Raspberry Pi to a different drive caused an invalid /boot/firmware/cmdline.txt root entry, failing to boot. Many thanks to @TimH for reporting this issue: https://dietpi.com/forum/t/25154
  • DietPi-Software | Docker: Resolved a v10.3 regression where a fresh Docker installation failed, since --no-reload was used when unmasking docker.service, which prevents docker.socket from starting up as well. Many thanks to @peracchi for reporting this issue: https://github.com/MichaIng/DietPi/issues/8108
  • DietPi-Software | Home Assistant: Resolved an issue where the installation might have failed, when starting it from within a desktop session. As we used runuser, environment variables were passed through to uv, notably XDG_DATA_HOME, which was then used as install dir for Python, instead of the intended service user's home directory. All runuser calls have now been replaced by setpriv with the --reset-env flag, to guarantee a clean environment. Many thanks to @btuerk89 for reporting this issue: https://github.com/MichaIng/DietPi/issues/8116
  • DietPi-Software | Synapse: Resolved an issue where the installation might have failed, since dependencies were not installed as intended.
  • DietPi-Software | Immich/ownCloud Infinite Scale: Resolved a v10.3 regression, where the service failed to start, as it does not have the permissions to touch its environment file, to trigger the systemd automount, if needed. Instead of touch, automounts for environment files are now triggered with test -e, which does not require write access.
  • DietPi-Software | Prometheus Node Exporter: Resolved an issue on Raspberry Pi where the raspberrypi_exporter.service stored the CPU temperature in a wrong format, if a locale with comma (,) as decimal separator was selected on the host system. The service now enforces the C locale. The change is applied during the DietPi update as well. Many thanks to @Grip for reporting this issue: https://github.com/MichaIng/DietPi/issues/8118

Breaking Changes

  • Persistent DietPi log files moved from /var/tmp/dietpi/logs to /var/lib/dietpi/logs

Security Fixes

  • CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag) mitigated across all supported SBCs via kernel updates
  • DietPi update implicitly upgrades affected kernel packages
  • CVE-2026-43284
  • CVE-2026-43500

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track DietPi

Get notified when new releases ship.

Sign up free

About DietPi

Minimal Debian OS optimized for single-board computers, which allows you to easily install and manage several services for selfhosting at home.

All releases →

Related context

Related CVEs

Beta — feedback welcome: [email protected]