Connected products need a credible plan for security updates across their whole life in the field. Customers and auditors expect manufacturers to know what software they ship and to fix vulnerabilities promptly, and regulations such as the EU Cyber Resilience Act make this a requirement.
This page sets out what Raspberry Pi supports, how long we support it for, and what tools we provide to help you assess and manage vulnerabilities in your own products.
| What’s covered | What we provide | Support period |
| Linux kernel | Security and bug fixes on our current kernel, which tracks an upstream LTS release. The next kernel is available for testing ahead of the switch. | While it is our current kernel; we move to newer LTS releases as they mature |
| Current release of Raspberry Pi OS | Full package updates, following Debian stable | For the life of the release as Debian stable |
| Legacy release of Raspberry Pi OS (previous version to current) | Fixes for significant vulnerabilities with known exploits | During the release’s Debian LTS period |
| CVE analysis | A public list of CVEs affecting Raspberry Pi OS, with our assessment, updated weekly | No end date |
We recommend staying on the current Raspberry Pi kernel rather than pinning an older one. It is where most of our users, testing, and fixes are concentrated, so it is the safest place to be.
The Linux kernel is maintained by a large community of developers who continually review code and fix vulnerabilities. Fixes land first in the latest mainline kernel, then are backported to the long-term support (LTS) branches. Current LTS branches include 6.1, 6.6, 6.12 and 6.18; endoflife.date lists their support dates.
Our Linux team maintains two kernels at any time:
We understand that many industrial customers would prefer a single kernel for the life of a product. Even upstream LTS branches are only maintained for a few years, though, and an old kernel that few people run receives less scrutiny than the current one. Planning to move with our kernel releases, and testing against the next one early, makes it routine to keep up to date and avoids the risks associated with using an older kernel.
Raspberry Pi OS follows the Debian release cycle, so you can plan around Debian’s published timeline on endoflife.date. A new Debian release arrives roughly every two years.
For a list of current security advisories, and to sign up to our mailing list to be informed of any important vulnerabilities, please visit our security page.
Tools that make it easier to stay current
Staying current is only realistic if rebuilding, deploying, and updating a product is easy. Raspberry Pi provides three tools to cover that lifecycle: to build the image, provision devices securely at manufacture, and then update and support them in the field.
Build – rpi-image-gen
rpi-image-gen builds product images from the latest Debian packages and Raspberry Pi kernel. Because a build is repeatable, you can re-run it whenever new package or kernel versions are released, rather than maintaining a hand-patched image. It produces images that support the security features of rpi-sb-provisioner, including secure boot, A/B booting, and in-field OTA updates.
Manufacture – rpi-sb-provisioner
rpi-sb-provisioner prepares devices on the production line. It supports:
Deploy and support – Raspberry Pi Connect
Raspberry Pi Connect lets you update a fleet of devices over the air from the Connect website. It also gives you remote shell and screen sharing, so you can debug devices in the field without a site visit.
If your product has requirements this approach doesn’t meet, such as a kernel that must stay fixed for a decade, please talk to us – you can contact us by emailing [email protected]. Those conversations shape what we build next.