Hello,We are assessing security maintenance for an STM32MP1 product using linux-stm32mp. Could ST clarify the following? Is the maintenance policy in the 2021 "FAQ: Updating OpenSTLinux" (https://community.st.com/stm32-mpus-61/faq-updating-openstlinux-19) still current? How are security fixes delivered after a release: through component branches, tagged minor releases, or another mechanism? Has ST published updated guidance in preparation for the EU Cyber Resilience Act? Does ST assess kernel.org CNA CVEs against its vX.Y-stm32mp branches? Are per-CVE affected/fixed decisions published anywhere, such as a vulnerability list, VEX document, or CVE_STATUS entries in meta-st-stm32mp? For security vulnerabilities in ST-specific kernel changes that have not been upstreamed, what is the CVE assignment and advisory process? Where are fixes announced? The FAQ describes 1.5 years of feature development, 2.5 years of corrections, and a possible additional year of vulnerability-related releases. Which BSP components does this cover, including Linux and U-Boot? Is there a published lifecycle table showing support phases and end dates for each OpenSTLinux release? Is the v6.1-stm32mp branch still maintained? Are security updates planned beyond r2.1 (Linux 6.1.82), and should users expect selected backports or updates to newer upstream 6.1.y baselines? Thank you.

Visitor

Question

OpenSTLinux BSP security maintenance: CVE tracking, backports and Linux 6.1 support

Hello,

We are assessing security maintenance for an STM32MP1 product using linux-stm32mp. Could ST clarify the following?

Is the maintenance policy in the 2021 "FAQ: Updating OpenSTLinux" (https://community.st.com/stm32-mpus-61/faq-updating-openstlinux-19) still current? How are security fixes delivered after a release: through component branches, tagged minor releases, or another mechanism? Has ST published updated guidance in preparation for the EU Cyber Resilience Act?
Does ST assess kernel.org CNA CVEs against its vX.Y-stm32mp branches? Are per-CVE affected/fixed decisions published anywhere, such as a vulnerability list, VEX document, or CVE_STATUS entries in meta-st-stm32mp?
For security vulnerabilities in ST-specific kernel changes that have not been upstreamed, what is the CVE assignment and advisory process? Where are fixes announced?
The FAQ describes 1.5 years of feature development, 2.5 years of corrections, and a possible additional year of vulnerability-related releases. Which BSP components does this cover, including Linux and U-Boot? Is there a published lifecycle table showing support phases and end dates for each OpenSTLinux release?
Is the v6.1-stm32mp branch still maintained? Are security updates planned beyond r2.1 (Linux 6.1.82), and should users expect selected backports or updates to newer upstream 6.1.y baselines?

Thank you.