CVE-2026-13199 describes insufficient entropy in the EEPROM firmware of Raspberry Pi 5 and Compute Module 5 devices. The firmware produces non-random KASLR and RNG seed values, resulting in predictable kernel addresses across device boots and units. This predictability can facilitate exploitation of other vulnerabilities by reducing randomness in memory layout. Additionally, the poor RNG seed quality may impact the randomness of generated numbers or cause boot delays as the system waits for sufficient entropy. There is no vendor advisory or patch information available at this time.

The vulnerability leads to predictable kernel address layouts and weak RNG seeds on affected Raspberry Pi devices. This reduces the effectiveness of KASLR as a security mitigation and may make exploitation of other vulnerabilities easier. The low-quality RNG seed can also affect cryptographic operations relying on randomness and may cause slower boot times due to entropy starvation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Raspberry Pi communications for updates. No specific mitigations are provided by the vendor at this time.