Thomas Petazzoni

sbom-cve-check 1.4.0 released

sbom-cve-check is a lightweight, standalone tool that analyzes a Software Bill of Materials (SBOM) against public vulnerability databases and reports which software components are affected by known vulnerabilities. It supports SBOMs in both SPDX v2.2 and SPDX v3.0 formats. It checks them against the NVD and CVE List vulnerability databases. Results can be exported in several formats, including SPDX v3.0 and the Yocto Project cve-check manifest format. It is developed and maintained by Bootlin engineer Benjamin Robin.

We are happy to announce the release of sbom-cve-check 1.4.0. This release adds an OpenVEX exporter, substantially improves the analysis of Linux kernel CVE version ranges, and makes version parsing and annotation handling more robust. As usual, the new version is available from PyPI and the release page, and the complete list of changes is in the changelog.

Continue reading “sbom-cve-check 1.4.0 released”

Welcome to Thomas Païta and Paul Cercueil

We recently welcomed two engineers to our team: Thomas Païta, based at our Lyon office, and Paul Cercueil, working from Madrid, Spain.

Thomas Païta

Thomas Païta Thomas joined Bootlin at the end of June 2026. After graduating from the Université de Technologie de Compiègne, he worked on embedded Linux and FreeRTOS at Sagemcom, followed by Rust and C++ development in the space industry. At Bootlin, his work will focus not only on Embedded Linux, but also on Zephyr.

Thomas is currently the 5th Thomas at Bootlin, joining Thomas Petazzoni, Thomas Perrot, Thomas Richard, and Thomas Bonnefille.

See his profile page for more details.

Paul Cercueil

Paul Cercueil Paul joined Bootlin in September 2026. After graduating in 2014 from the Université de Technologie de Belfort-Montbéliard, Paul worked at Analog Devices, where he designed and developed the ecosystem around Linux’ IIO subsystem and authored the companion libiio project. In addition to his work on IIO, Paul has extensive Linux kernel experience, with over 750 patches, mainly focused on supporting MIPS-based Ingenic SoCs, for which he is the platform maintainer. Paul also has a solid background in Buildroot, having been the main developer and maintainer of the Buildroot-based OpenDingux distribution, as well as contributing more than 60 patches to upstream Buildroot. Paul also enjoys tinkering with other retro-gaming console projects, including the KallistiOS project, an operating system for the SEGA Dreamcast, and a MIPS-to-everything JIT compiler for the PlayStation 1.

Paul is French and also speaks English and Spanish fluently. See his profile page for more details.

Bootlin toolchains 2026.08 released

We are happy to announce the release of a new version of our freely available, pre-compiled cross-compilation toolchains, hosted at toolchains.bootlin.com.

This update covers a range of 43 CPU architecture variants, including: aarch64, aarch64be, arcle-750d, arcle-hs38, armv5-eabi, armv6-eabihf, armv7-eabihf, armebv7-eabihf, armv7m, m68k-68xxx, m68k-coldfire, microblazebe, microblazeel, mips32, mips32el, mips32r5el, mips32r6el, mips64-n32, mips64el-n32, mips64r6el-n32, openrisc, powerpc-440fp, powerpc-e300c3, powerpc-e500mc, powerpc64-e5500, powerpc64-e6500, powerpc64-power8, powerpc64le-power8, riscv32-ilp32d, riscv64-lp64d, s390x-z13, sh-sh4, sh-sh4aeb, sparc64, sparcv8, x86-64, x86-64-v2, x86-64-v3, x86-64-v4, x86-64-core-i7, x86-core2, x86-i686, xtensa-lx60.

As with previous releases, we provide two editions of each toolchain: a stable version based on the N-1 releases of GCC, binutils, GDB, and slightly older kernel headers, and a bleeding edge version featuring the latest available components. For the 2026.08 release, the versions are:

The bleeding-edge toolchains are based on gcc 16.2, binutils 2.46.1, gdb 17.1, kernel headers 6.12, glibc 2.44, musl 1.2.6 or uclibc-ng 1.0.59.
The stable toolchains are based on gcc 15.3, binutils 2.45.1, gdb 16.3, kernel headers 5.10, glibc 2.44, musl 1.2.6 or uclibc-ng 1.0.59.

All toolchains are built for x86-64 Linux hosts and are compatible even with relatively old Linux distributions. We welcome bug reports and feedback through our project issue tracker.

sbom-cve-check 1.3.2 and 1.3.3: improved SBOM handling and more robust CVE analysis

Since our previous update on sbom-cve-check, the project has continued to evolve with two new releases: version 1.3.2, released in June, and version 1.3.3, released in August.

These releases bring a number of improvements to the handling of SBOM data, CVE version ranges and vulnerability assessments, as well as fixes for some corner cases encountered when analyzing real-world software projects.

For those discovering the project, sbom-cve-check is a lightweight open-source tool developed by Bootlin for performing vulnerability analysis on Software Bill of Materials (SBOMs). It is based on SPDX SBOMs and can be used both as a standalone tool and through its integration in the Yocto Project. Since the Yocto Project’s Wrynose release, sbom-cve-check has been used as the Yocto Project’s official tool for CVE monitoring.

Continue reading “sbom-cve-check 1.3.2 and 1.3.3: improved SBOM handling and more robust CVE analysis”

Understanding the Linux Graphics Stack is now available as a self-paced video course

Bootlin’s Understanding the Linux Graphics Stack training course is now available as a self-paced, pre-recorded video course on Udemy.

This course has previously been offered as an instructor-led training course. We are now changing its format: it is no longer available as an instructor-led course and is instead offered as a pre-recorded course that you can follow at your own pace.

For now, Understanding the Linux Graphics Stack is the only Bootlin training course available in a self-paced format. All of our other training courses continue to be offered as instructor-led training sessions.

Continue reading “Understanding the Linux Graphics Stack is now available as a self-paced video course”

Bootlin at Open Source Summit Europe 2026 and Linux Plumbers 2026

From October 5 to October 9 this year, Prague will be the place to be for the open-source community, and especially for embedded open-source developers. The Open Source Summit Europe will take place there from October 7 to 9, while Linux Plumbers Conference will run from October 5 to 7. Numerous co-located events are also being organized around these two major conferences.

Bootlin will once again have a strong presence in Prague, both in terms of attendance and technical presentations.

Continue reading “Bootlin at Open Source Summit Europe 2026 and Linux Plumbers 2026”

Welcome to Paul Louvel and Diogo Ivo

We recently welcomed two engineers in our team located in Toulouse, France: Paul Louvel and Diogo Ivo.

Paul Louvel

Paul Louvel Paul joined Bootlin in February 2026, after graduating from École 42, with a combined apprenticeship at IDEMIA on SIM card technology projects, implementing the (D)TLS protocol in a smart card operating system. At Bootlin, Paul already contributed to the development and customization of Linux BSPs targeting x86-based Intel platforms, PowerPC, and ARM-based NXP platforms, using both Yocto and Buildroot. Paul is also contributing to the Linux kernel, developing and making changes to various drivers using different subsystems, including GPIO, IRQ, and crypto.

Check out Paul’s page on bootlin.com, LinkedIn profile and Linux kernel commits.

Diogo Ivo

Diogo Ivo Diogo joined Bootlin at the beginning of June 2026. Diogo graduated with a Master’s Degree in Engineering Physics from Instituto Superior Técnico (Portugal) in 2022. From 2023 to 2026, he worked at Siemens as an Embedded Linux engineer, working with edge industrial platforms and gaining experience in Yocto integration, platform maintenance and BSP kernel updates. He also contributed to the upstream Linux kernel, namely an Ethernet driver for the Texas Instruments AM654x SR1.0 SoC and a watchdog driver for the Intel Over-Clocking watchdog.

Check out Diogo’s page on bootlin.com, LinkedIn profile and Linux kernel commits.

We’re happy to see two young and talented engineers join our team to work on the numerous embedded Linux projects from our customers!

Embedded Linux Security training: materials available, new sessions open

Embedded Linxu Security training from Bootlin Back in April 2026, we announced our brand new Embedded Linux Security training course, prepared by Bootlin engineers Olivier Benjamin and Mathieu Dubois-Briand.

We are happy to be sharing a number of updates regarding this training: feedback from the first sessions, availability of complete training materials, and new public sessions being available end of 2026.

Continue reading “Embedded Linux Security training: materials available, new sessions open”

sbom-cve-check updates: integrated in Yocto 6.0 Wrynose, Schneider Electric support, new releases, and more

Back in December 2025, we announced the release of sbom-cve-check, a lightweight CVE analysis tool for your Software Bill of Materials (SBOM). Since the announcement, we have announced a number of updates and new releases, but work has continued, and we have several new updates to share about sbom-cve-check.

Continue reading “sbom-cve-check updates: integrated in Yocto 6.0 Wrynose, Schneider Electric support, new releases, and more”

Bootlin engineer Alexis Lothoré invited at the Linux Storage Filesystem & Memory Management & BPF Summit

The Linux Storage, Filesystem, Memory Management & BPF Summit (LSFMMBPF) brings together leading developers, researchers, and Linux kernel subsystem maintainers to discuss, design, and implement improvements to the filesystem, storage, and memory management subsystems. The work initiated at this event typically makes its way into the mainline kernel and Linux distributions within the following 24 to 48 months.

In the context of the partnership between Bootlin, the eBPF Foundation and the Alpha Omega organization, Bootlin engineer Alexis Lothoré is currently working on adding KASAN memory checker support to the eBPF subsystem: this work aims to make it easier for eBPF subsystem developers to catch (early) bugs that could be introduced in complex parts of the kernel, like in the eBPF verifier.

This work has already led to some initial design discussions and proof of concept implementation on the kernel mailing lists, but as it requires some close collaboration with kernel developers and maintainers, Alexis has also been invited to attend LSFMMBPF 2026, taking place from May 4th to May 6th in Zagreb, Croatia, and will present his ongoing work on “Adding KASAN support for JITed programs”. This will be the opportunity to discuss and iron out the roadblocks and details to get the feature integrated in the kernel, as this event is not really a classic conference in which people primarily attend talks: the goal really is to trigger discussions to make solutions and features move forward in the kernel, in a “workshop-like” atmosphere. This work is one among many others on-going topics in the Linux kernel that need discussions, more details are available in the full event schedule.

We are proud to have one of our engineers contributing to this gathering of Linux kernel experts. This invitation highlights Bootlin’s strong involvement in upstream Linux kernel development.