Main changes between OpenWrt 25.12.5 and OpenWrt 25.12.6
Only the main changes are listed below. See the full changelog for details.
Security fixes
This release fixes several remotely triggerable vulnerabilities in core network
services that are enabled by default. Updating is strongly recommended.
uhttpd (web server, enabled by default with LuCI): uhttpd was updated to a newer version that fixes five published advisories, all reachable without authentication:
CVE-2026-102338 (High): memory-exhaustion denial of service caused by an unlimited number of HTTP request headers. GHSA-vhx4-3p5q-m59q
No CVE assigned (High): out-of-bounds write caused by a type confusion of the params field in POST /ubus/call/ requests. GHSA-2mpg-6wp5-435p
No CVE assigned (High): unlimited memory growth, because the URL path was leaked on every non-POST /ubus request. GHSA-83vv-qrc6-h3hx
No CVE assigned (Moderate): HTTP request smuggling (CL.0), because a keep-alive connection was reused while a request body was still unread. GHSA-c2wg-hcff-hqrm
No CVE assigned (Moderate): a leaked client reference on /ubus/subscribe/ could permanently block the listener. GHSA-wvgh-cm54-q6f6
Mbed TLS (default TLS library): update to 3.6.7, fixing multiple security vulnerabilities, including a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites (CVE-2026-25832, CVE-2026-35336, CVE-2026-49300, CVE-2026-50579, CVE-2026-50580, CVE-2026-50581, CVE-2026-50583, CVE-2026-50584, CVE-2026-50585, CVE-2026-50586, CVE-2026-50587, CVE-2026-50588, CVE-2026-50640, CVE-2026-50713, CVE-2026-54435, CVE-2026-54441). Mbed TLS is used by default, for example for HTTPS in uhttpd and in hostapd / wpa_supplicant.
hostapd / wpa_supplicant (WiFi):
No CVE assigned: fixes from the hostapd security advisory 2026-1 for missing validation when parsing multi-link (MLO, WiFi 7 / IEEE 802.11be) information. Invalid management frames sent without authentication could crash hostapd or wpa_supplicant or cause small memory corruption. In access point mode, only devices with WiFi 7 (802.11be) support are affected. In client mode, wpa_supplicant is affected in general. https://w1.fi/security/2026-1/
No CVE assigned (Moderate, CVSS 6.5): NULL pointer dereference in the APuP (Access Point Micro-Peering) beacon handling. A nearby attacker could crash hostapd by sending beacons from many spoofed BSSIDs. Only relevant if APuP is enabled (option apup, disabled by default). https://github.com/openwrt/openwrt/security/advisories/GHSA-78g5-4g76-r6jh
In builds using Mbed TLS, the check_cert_subject EAP server certificate check read uninitialized memory and could accept a certificate whose subject only matched as a prefix.
rpcd (LuCI backend, enabled by default with LuCI): two privilege escalation issues were fixed. They only matter on systems with additional LuCI users with limited (delegated) permissions:
LuCI applications and packages: several issues were fixed that let a logged-in user with limited (delegated) permissions run commands as root or store cross-site scripting (XSS) payloads. They only apply if the affected app is installed and the account/ACL in question exists:
ser2net / luci-app-ser2net (Critical, CVSS 9.9): a newline in a UCI option could add an extra ser2net connection that runs commands as root. GHSA-w6q2-vr4f-49x3
luci-app-lxc: path traversal and an ACL bypass allowed logged-in users without the LXC permission to get root access on the host (no advisory published).
luci-app-ddns / ddns-scripts: delegated DDNS users could run commands as root through the date format and other DDNS settings, which were passed to the shell without quoting (no advisory published).
luci-app-nut: delegated users could configure NUT notification commands that run as root. Write access is now limited to the admin user (no advisory published).
luci-app-adblock-fast (Moderate, CVSS 5.4): stored XSS in the status page through blocklist names. GHSA-q335-4c83-c88h
luci-app-https-dns-proxy (Moderate, CVSS 4.5): stored XSS in the status page through the resolver URL. GHSA-c6vf-395q-4jv6
luci-base: the URL path and user name are now escaped when logging, so crafted login requests can no longer inject text into the system log.
umdns (mDNS daemon, optional package): two out-of-bounds reads reachable by any host on the local network with crafted mDNS packets were fixed:
Many optional packages in the packages feed were also updated to new versions with
security fixes, among them curl 8.22.0, OpenSSH 10.6p1, unbound 1.26.1, BIND 9.20.29,
OpenVPN 2.7.7, strongSwan 6.0.7, HAProxy 3.2.21, expat 2.8.4, nghttp2 1.70.0,
libssh 0.12.2, c-ares 1.34.8, Tor 0.4.9.13, Knot DNS 3.5.7, PowerDNS 4.9.17,
PowerDNS Recursor 5.2.13, Exim 4.100.1, Python 3.13.15, Node.js 22.23.2, xz 5.8.3
and rsync 3.5.1. These packages are not part of the default images; update the
installed packages to get these fixes.
Beyond the issues listed above, this release fixes a number of further security
problems for which no CVE number or dedicated advisory was assigned. We strongly
recommend upgrading to the latest OpenWrt release and installing all available
package updates.
Important changes
WiFi: GCMP-256 and SAE-EXT-KEY are no longer offered by default
OpenWrt 25.12.0 to 25.12.5 offered the GCMP-256 pairwise cipher and, in some configurations, the SAE-EXT-KEY key management (SAE with a group-dependent hash, also called SAE-GDH) on WPA3 networks with WiFi 6 (HE) or WiFi 7 (EHT), but not in the way the Wi-Fi Alliance "WPA3 and Wi-Fi Enhanced Open Deployment and Implementation Guide" describes it. This configuration caused connection problems, for example with Pixel 10 phones (#21486) and with 802.11r Fast Transition (#22200).
The WPA3 specification makes GCMP-256 and SAE-EXT-KEY mandatory for WiFi 7 and recommends them otherwise. When the configuration recommended by the Wi-Fi Alliance was enabled in the OpenWrt development branch, it turned out that about 15% of the client devices in use are not compatible with it. For example:
Some clients cannot connect when GCMP-256 is offered, already on WiFi 6, for example Nanoleaf devices, a Motorola/Unisoc phone and Linux laptops using iwd.
With 802.11r Fast Transition enabled, FT-SAE-EXT-KEY prevents some clients from connecting (for example a Samsung Galaxy Tab S10 FE) or makes them reboot shortly after connecting (for example a Poco X6).
Starting with 25.12.6, GCMP-256 and SAE-EXT-KEY are no longer offered by default in WPA3-Personal (sae) and WPA2/WPA3 mixed (sae-mixed) mode; only CCMP and plain SAE are offered. The old rsn_override option was removed.
We recommend using WPA3-Personal (sae) or WPA2/WPA3 mixed mode (sae-mixed). If some clients have problems with these modes, use the new WPA3-Personal Compatibility Mode (sae-compat, "WPA2-PSK/WPA3-SAE Compatibility Mode" in LuCI): WPA2 clients see a normal WPA2 network, while clients that support RSN overriding use WPA3.
Only enable GCMP-256 and SAE-EXT-KEY if you need them and if they do not cause problems with your clients. In LuCI, they are on the "Wireless Security" tab of the wireless network as "GCMP-256 pairwise cipher" and "SAE-EXT-KEY (SAE-GDH)". On the command line (replace default_radio0 with the name of your wifi-iface section):
uci set wireless.default_radio0.gcmp256='1'
uci set wireless.default_radio0.sae_ext_key='1'
uci commit wireless
wifi reload
gcmp256 offers GCMP-256 in addition to CCMP, but only if the WiFi driver supports GCMP-256. sae_ext_key offers SAE-EXT-KEY, and also FT-SAE-EXT-KEY when 802.11r is enabled.
DHCP client: the client identifier can be selected
Since OpenWrt 25.12.0, every device generates a random, UUID-based DUID on first boot and stores it in network.globals.dhcp_default_duid. The DHCPv6 client uses it as its DUID, and the DHCPv4 client sends it together with an interface-specific IAID as client identifier (DHCP option 61). This default follows the recommendation of RFC 4361 (https://www.rfc-editor.org/rfc/rfc4361) that DHCPv4 clients use the same DUID as DHCPv6, so the device is identified in the same way for DHCPv4 and DHCPv6. The UUID-based DUID format is defined in RFC 6355 (https://www.rfc-editor.org/rfc/rfc6355). OpenWrt 24.10 sent no client identifier with DHCPv4 and used a DUID-LL derived from the MAC address for DHCPv6. Some DHCP servers, including servers of some ISPs, do not work correctly with the new client identifier, and until now there was no way to go back to the old behavior.
OpenWrt 25.12.6 adds the new per-interface option sendclientid:
auto (default): use the client ID configured with the clientid option, else the default DUID of the device, else the MAC address. This is the behavior of 25.12.0 to 25.12.5 and follows RFC 4361.
global: always use the default DUID of the device, even if clientid is set.
hardware: use the MAC address of the interface (DHCPv4) or a DUID-LL derived from it (DHCPv6).
none (DHCPv4 only): do not send a client identifier at all.
We recommend keeping the default auto, which matches the behavior of OpenWrt 25.12.5. Only if the DHCP server of your ISP does not work with it, switch back to the behavior of OpenWrt 24.10 by setting none on the DHCPv4 interface and hardware on the DHCPv6 interface:
uci set network.wan.sendclientid='none'
uci set network.wan6.sendclientid='hardware'
uci commit network
service network reload
In LuCI, the option is called "Preferred client ID" and is on the "Advanced Settings" tab of the interface (Network → Interfaces → Edit). Select "None" for the DHCPv4 interface (wan) and "Hardware address" for the DHCPv6 interface (wan6). Note that the DHCP server sees a changed client identifier as a new client, so you may get a different IPv4 address or IPv6 prefix.
kernel: add support for FudanMicro FM25G01B/FM25G02B SPI-NAND (fixes a boot loop on new revisions of Keenetic KN-1812 / Netcraze NC-1812) and HeYangTek HYF1GQ4UDACAE SPI-NAND (found on some Keenetic KN-3411 units)
mediatek: MT7986 - correct the system timer rate, fixing clock drift (e.g. NTP running at the +500 ppm limit on the GL.iNet GL-MT6000)
mediatek (filogic): Cudy devices with DDR3 RAM - run the RAM at its rated speed of 1866 MT/s
mediatek (filogic): JioRouter AX6000 JIDU6101 - fix silently failing sysupgrade (SPI-NAND writes) and the U-Boot environment layout
mediatek (filogic): Keenetic / Netcraze devices - fix NMBM reserved block count, fixing boot on some units
mpc85xx: Freescale P2020RDB - switch to DSA (see "Upgrading" below); TP-Link TL-WDR4900 v1 - the WiFi on/off switch now works; Enterasys WS-AP3715i - fix boot and allow access to the U-Boot environment
mvebu: Turris MOX - fix sysupgrade, squashfs boot and USB 2.0 device detection; WiFi (mwifiex SDIO) and Bluetooth drivers are now included in the image
qualcommax: ASUS RT-AX89X - use LAN1 instead of the SFP port in failsafe mode (#23633)
qualcommbe: ipq95xx - check the image metadata on sysupgrade
realtek: D-Link DGS-1210-28P/MP - fix fan control
rockchip: NanoPi R3S (1 GB) - fix the PCIe link to the RTL8111H Ethernet chip
sunxi: H5 boards (e.g. NanoPi NEO 2) - fix USB
airoha: new PCS implementation, Ethernet LRO and HW-GRO support, many Ethernet driver fixes, AN7583 USB/PCIe PHY support, updated pin controller driver and thermal settings
WiFi fixes and improvements
The WPA3 defaults were reworked to follow the WPA3 specification and deployment guide:
GCMP-256 and SAE-EXT-KEY are no longer offered by default in sae and sae-mixed mode (see "Important changes" above)
Beacon protection is now enabled by default on supported devices when management frame protection (PMF / 802.11w) is enabled
SAE now offers the groups 19, 20 and 21 by default
New WPA3-Personal Compatibility Mode (sae-compat): WPA2 clients see a normal WPA2 network, while clients that support RSN overriding use WPA3
New transition_disable option to tell clients to stop falling back to older security modes on a WPA3-only network
On 6 GHz, SAE uses H2E only, and WPA2-only configurations are automatically switched to WPA3 so the radio comes up
LuCI shows the new options in the wireless settings and hides encryption modes that are not allowed on 6 GHz
WiFi client (wpa_supplicant) with WPA-Enterprise: fix EAP inner methods such as EAP-MSCHAPV2 (#24086), fix server certificate checks (altsubject_match, domain_match, domain_suffix_match), and accept the old priv_key / priv_key_pwd option names again, so EAP-TLS client configurations from 24.10 work again (#22599)
hostapd: fix EAP-TLS client mode with Mbed TLS 3.6.3 and newer
wifi-scripts: restore 802.11ad (60 GHz) support
wifi-scripts: the multicast_to_unicast option works again
hostapd: restore Link Measurement Report handling; beacon reports via ubus support the reporting detail parameter and include the raw report data
mac80211: update to 6.18.55 with many upstream fixes for ath10k, ath11k, iwlwifi, rtw88 and other drivers
ath9k: reset the hardware on init again, fixing problems on some devices
rtw88 (USB/SDIO): use a longer TX report timeout, fixing repeated "failed to get tx report from firmware" warnings in access point mode
mt76: backport fixes from Linux 6.18.55
iwinfo: fix corrupt scan results when wpa_supplicant is running; add new device IDs
iw: show RSN Override elements in scan results
Network and service improvements
DHCP client: new per-interface option sendclientid to choose the DHCPv4/DHCPv6 client identifier (see "Important changes" above)
ppp: on-demand dialing (demand option) works again. It was broken since the update to ppp 2.5.0 (#24454).
uhttpd: stricter and more robust HTTP parsing, lower latency (TCP_NODELAY), can bind to addresses that are not yet configured, and supports SNI-based redirects
umdns: many robustness fixes
L2TP: fix heavy packet fragmentation, seen for example with batman-adv over an L2TP tunnel over IPv4
Mobile broadband: uqmi and umbim now report the DNS servers in ifstatus also with peerdns disabled; support for the Quectel EG120K-EA modem (qmi_wwan); NCM support for Fibocom FG621-EA modems (e.g. ASUS 4G-AX56, TP-Link TL-MR500 v1)
adb: fix RSA authentication with Mbed TLS
Other changes
LuCI: new optional theme luci-theme-footstrap; the optional luci-mod-dashboard got live charts and a configurable layout; new apps luci-app-librespeed and luci-app-weechat
Core component updates
Linux kernel: update from 6.12.94 to 6.12.112
OpenSSL: update from 3.5.7 to 3.5.9 (multiple security fixes, see above)
Mbed TLS: update from 3.6.6 to 3.6.7 (multiple security fixes, see above)
wolfSSL: update from 5.9.1 to 5.9.4 (multiple security fixes, see above)
mac80211: update from 6.18.26 to 6.18.55
wireless-regdb: update from 2026.05.30 to 2026.09.03
nilfs-utils: update from 2.2.12 to 2.2.17
ca-certificates: update from 20260601 to 20260816 (refreshed root CA bundle)
wireguard-tools: update from 1.0.20250521 to 1.0.20260223
uhttpd, rpcd, umdns, odhcp6c and iwinfo: updated to newer upstream versions
Upgrading to 25.12.6
Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.
For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.
Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.
Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. fc0c518
Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. cd8dcfe
DHCP client identifier: Since 25.12.0, the DHCP clients identify the device with a UUID-based DUID instead of the MAC address. If your ISP's DHCP server has problems with this, set the new sendclientid option to get the behavior of OpenWrt 24.10 back, see "Important changes" above.
bcm53xx devices with NAND flash: Since 24.10, sysupgrade lost the configuration on these devices. This is fixed in 25.12.6, but because the fix is in the firmware that does the flashing, the upgrade to 25.12.6 loses the configuration one last time. Back up your configuration before upgrading and restore it afterwards. 67b18c1
Freescale P2020RDB: The switch was converted from swconfig to DSA. The configuration cannot be migrated, so upgrade without keeping the settings (sysupgrade -n).
TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in OpenWrt 25.12.1 to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).
Meraki MX60: Direct sysupgrade to 25.12.6 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.
Sitecom WLR-7100 (X7 AC1200): This device was moved from the ath79/generic target to the ath79/tiny target in OpenWrt 25.12.4. Users upgrading from 25.12.3 or earlier need to flash the new image from the ath79/tiny target (use sysupgrade -F).
Known issues
Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations. #22344
qualcommax/ipq50xx: Ethernet ports do not work. #25975
One device, however you connect it. The same mouse now keeps one device card and one set of settings across receiver and USB connections. Existing configurations migrate automatically and are backed up before the first save. (#876)
A redesigned device workspace makes larger setups easier to manage. A responsive grid, compact cards, clearer battery status, custom device names, scalable interface presets, and a dedicated action menu make devices faster to scan and configure.
Per-app profiles are now editable in the GUI. Pick an installed application from the new catalog, see which profile is active, and customize its button bindings without editing TOML. (#976)
Scrolling is smoother and more configurable. Built-in smooth scrolling, vertical sensitivity controls, preserved fractional motion, rebindable wheel tilt, and fixes for diverted high-resolution wheels deliver more consistent scrolling across main and thumb wheels. (#902, #925, #992)
Buttons can now distinguish a tap from a hold. TOML bindings can assign independent short- and long-press actions with a 500 ms threshold, while held shortcuts remain active until the button is released. (#961)
What's Changed
chore(gui): bump gpui-component to da4f9369 by @AprilNEA in #655
refactor(hid): centralize device identities by @AprilNEA in #831
docs(agents): scale local gate to affected packages by @AprilNEA in #696
feat(core,gui): make the main wheel's tilt rebindable (MX anywhere 2s,...) by @6lv1-blr in #902
fix(linux): install the app icon at every indexed hicolor size by @4ni1ak in #837
fix(gui): recognize mx ergo wheel tilt metadata by @AprilNEA in #905
ci: automate typo checks and consolidate configs by @AprilNEA in #906
refactor(gui): convert app state to entity events by @AprilNEA in #904
fix(mouse): compose thumb-wheel preset labels from translated action names by @NatsUIJM in #910
fix(linux): restore glibc 2.35 package baseline by @AprilNEA in #911
fix(gui): restore full-phrase thumb-wheel preset labels by @AprilNEA in #913
refactor(gui): componentize free-function builders by @AprilNEA in #914
fix(macos): honor XDG state dir in permission diagnostics by @AprilNEA in #915
fix(hid): improve Unifying receiver discovery reliability by @v14 in #853
feat(gui): add per-app profiles and redesign device workspace by @AprilNEA in #907
fix(macos): use reliable async-hid report writes by @sh3ll3x3c in #889
fix(hid): preserve usage pairs in native handle cache by @sh3ll3x3c in #882
fix: show Windows MSI completion and failure state by @mvanhorn in #819
feat(gui): make custom controls keyboard-operable by @AprilNEA in #916
style(gui): refine profile toolbar layout by @AprilNEA in #921
refactor(gui): clean up render paths and element ids by @AprilNEA in #926
fix(hidpp): read Unifying link encryption from bit 5, not the software-present bit by @AprilNEA in #924
refactor(gui): tighten typed rendering and async ownership by @AprilNEA in #931
refactor(gui): move device reads onto swr by @AprilNEA in #929
feat(gui): add scalable interface presets by @AprilNEA in #934
feat(agent): unify button Down/Up/Cancel lifecycle by @AprilNEA in #933
feat(i18n): add Turkish (tr) interface locale by @4ni1ak in #835
feat(gui): add switchable device gallery views by @AprilNEA in #927
refactor(gui): improve shared component quality by @AprilNEA in #966
feat(agent): hold shortcut output until button release by @AprilNEA in #960
fix(thumbwheel): scale remapped vertical scrolling by @hsearcy in #925
refactor(gui): structure app state by domain by @AprilNEA in #974
feat(gui): add installed application catalog picker by @AprilNEA in #976
feat(gui): add polished battery indicator by @AprilNEA in #983
feat(scroll): preserve precise scroll distances by @AprilNEA in #973
ci: replace target caches with sccache by @AprilNEA in #984
feat(scroll): add finite smooth scroll runtime by @AprilNEA in #975
feat(scroll): smooth diverted thumbwheel input by @AprilNEA in #977
feat(gui): polish the app catalog picker and device cards by @AprilNEA in #986
feat(scroll): add vertical scroll sensitivity by @AprilNEA in #978
feat(scroll): expose smooth scrolling setting by @AprilNEA in #979
refactor(gui): strengthen typed render boundaries by @AprilNEA in #981
fix(core,gui,agent): key device settings by identity, not by transport by @yuzi-co in #876
feat(agent): dispatch independent long-press actions by @AprilNEA in #961
refactor(agent): complete thumbwheel state machine by @AprilNEA in #968
fix(hid): preserve diverted wheel reporting by @AprilNEA in #992
v0.7.5 and v0.7.6 were tagged but never published — their macOS packaging failed before a single artifact was uploaded, so no release exists for either. Everything both of them contained ships here, and the changes below cover everything since v0.7.4.
What's Changed
docs(ci): map every CI job to a local command by @davidbudnick in #732
The OpenWrt community is proud to announce the newest stable release of the OpenWrt 24.10 stable series.
This release fixes many security issues, several of them remotely triggerable in network services that are enabled by default. We strongly recommend everyone to upgrade.
The OpenWrt 24.10 series is in security maintenance (only security problems are fixed), with end of life (EoL) projected for September 2026. We recommend migrating to OpenWrt 25.12 before then.
Download firmware images using the OpenWrt Firmware Selector:
Main changes between OpenWrt 24.10.7 and OpenWrt 24.10.8
Only the main changes are listed below. See changelog-24.10.8 for the full changelog.
Security fixes
This release fixes several remotely triggerable vulnerabilities in core network
services that are enabled by default. Updating is strongly recommended.
odhcpd (DHCPv6/DHCPv4/RA server, enabled by default): multiple vulnerabilities reachable by a network-adjacent, unauthenticated attacker were fixed:
CVE-2026-53921 (Critical): stack buffer overflow in the DHCPv6 IA reply serialization, triggerable with crafted DHCPv6 REQUEST packets. GHSA-7fwx-hhrg-3496
Reconfigure-Accept stack buffer overflow (High, no CVE assigned): the Reconfigure-Accept reply block wrote 36 bytes into the response buffer without checking the remaining space, leading to a pre-auth out-of-bounds write. https://github.com/openwrt/openwrt/security/advisories/GHSA-q6wx-p68j-chp9
CVE-2026-53918 (High): use-after-free through a dangling first-lease pointer in the DHCPv6 IA handler. GHSA-44ff-jcwh-wgc2
CVE-2026-53920 (High): stack memory disclosure via a truncated DHCPv6 IA_NA/IA_PD option. GHSA-p769-5v73-pc4f
CVE-2026-53922 (Moderate): pre-auth denial of service via a size_t underflow in DHCPv6 IA handling. GHSA-7hcw-g2jh-pqv5
NDP hop-limit spoofing (Moderate, CVSS 5.4, no CVE assigned): the NDP relay accepted IPv6 Neighbor Solicitations with a hop limit other than 255 (RFC 4861 violation), letting an off-link attacker spoof NS packets through the relay. Only relevant when the NDP relay is enabled. https://github.com/openwrt/odhcpd/security/advisories/GHSA-qvg7-9jf5-wgjc
odhcpd / LuCI stored XSS: CVE-2026-62948 (Critical): an unauthenticated DHCPv6 client could inject lease-file lines through a crafted FQDN hostname, resulting in stored cross-site scripting on the LuCI DHCPv6 leases status page. Fixed by escaping client hostnames in the lease state file. GHSA-hhmc-92hw-535f
uhttpd (web server, serves LuCI): three HTTP request smuggling issues on keep-alive connections were fixed:
CVE-2026-55612 (High): invalid chunk-length state reset. GHSA-p55c-rmhc-qfm5
CVE-2026-55613 (Moderate): ubus POST body parse-error desync. GHSA-wgwp-64hh-f52p
In addition uhttpd received hardening without an assigned CVE: a one-byte overflow in uh_urldecode(), an off-by-one out-of-bounds read in uh_b64decode(), constant-time password comparison and stricter handling of $p$ crypt-hash entries in the authentication realm.
rpcd: ACL bypass through symlinks (High): the file plugin matched ACL grants against the textual path but then followed symlinks unchecked, so a symlink inside an ACL-covered directory let a limited account read or write arbitrary root-owned files. The path is now re-resolved and re-authorized for every operation that dereferences the final component. https://github.com/openwrt/openwrt/security/advisories/GHSA-q5gr-86pq-vvwr
cgi-io (file upload/download helper used by LuCI, installed by default with LuCI):
CVE-2026-62947 (Moderate): ACL bypass and arbitrary root file read — the download and exec paths were checked against the ACL before being canonicalized, so path traversal let an authenticated user with wildcard read permission read any root-readable file (e.g. /etc/shadow). GHSA-jw5r-xhf5-2xcq
LuCI (web interface): several issues in LuCI modules and applications were fixed. The privilege-escalation issues only apply if the affected app is installed and a limited (delegated) account with the relevant ACL exists:
luci-app-ddns (High): the ucode status backend passed DDNS UCI values such as lookup_host, dns_server and the section name to system() as an unquoted shell string, so anyone able to write DDNS configuration could execute commands as root. The invocations now use the array form of system(). https://github.com/openwrt/openwrt/security/advisories/GHSA-32r4-3wh2-qvq3
luci-app-samba4 (High): the read ACL granted exec permission for smbd in general rather than only smbd -V, allowing read-only accounts to run arbitrary commands as root. GHSA-vx64-mmp7-h36c
luci-app-upnp (High): stored XSS — an unauthenticated LAN client can inject JavaScript through a UPnP port-mapping description, which the underlying daemon does not sanitize. The description is now HTML-escaped. GHSA-8v49-6387-7f89
luci-mod-status (High): stored XSS via a DHCP/DHCPv6 lease hostname shown in the lease status tables. Together with the odhcpd fix above this closes the injection path from an unauthenticated DHCP client into the LuCI admin UI. GHSA-686p-p8p9-x6fh
luci-base: the dispatcher now escapes the URL path and user name when logging, so crafted login requests can no longer pollute the system log.
The LuCI rpcd ACL files were adjusted for the symlink-aware rpcd ACL check mentioned above, so that /proc paths that are symlinks (such as /proc/mounts) keep working.
umdns (mDNS responder): CVE-2026-55492 (Moderate, CVSS 6.5): an unauthenticated attacker on the local network segment could flood the daemon with unique mDNS records; the unbounded cache exhausted the heap and took the whole device into out-of-memory. Fixed by bounding the cache size and clamping hostile TTLs. GHSA-jg8f-fhfw-jg46
ead (Emergency Access Daemon): CVE-2026-55490 (Moderate): an integer underflow in handle_send_a() allowed an unauthenticated attacker on the local segment to crash the daemon with a single crafted packet. GHSA-9558-77jp-g3fw
dropbear (SSH): security fixes from upstream 2026.90 were backported:
CVE-2019-6111: a malicious server could make the scp client overwrite unexpected local files (missing OpenSSH patch). Note the accompanying upstream behaviour change: scp -r is now rejected when the target directory already exists.
CVE-2026-35385: scp did not clear setuid/setgid bits on received files.
An authenticated user could bypass an authorized_keysforced_command option when dropbear runs with -t; authorized_keys is now opened non-blocking (local denial of service via special files); and a close() on a file descriptor obtained from an out-of-bounds read was fixed.
musl libc: backport of the upstream fixes for CVE-2026-6042 (algorithmic-complexity denial of service in iconv) and CVE-2026-40200 (stack corruption in qsort with sufficiently large inputs).
In addition, the packages feed shipped with this release moved a number of
optional packages to newer upstream versions that contain security fixes, among
them curl (8.12.1 to 8.19.0), expat (2.7.4 to 2.8.2), BIND (9.20.23 to 9.20.26),
PHP 8 (8.3.29 to 8.3.32), Tor (0.4.8.22 to 0.4.9.10), unbound (1.24.2 to 1.25.1),
lighttpd (1.4.82 to 1.4.85), haproxy (3.0.19 to 3.0.25) and rsync (3.4.2 to 3.4.3).
collectd also received a fix for a use-after-free in the ping plugin. These
packages are not part of the default images — you have to update the installed
packages on your device to receive them.
Beyond the issues listed above, this release fixes a number of further security
and robustness problems in odhcpd, odhcp6c, rpcd and uhttpd for which no CVE
number or dedicated advisory was assigned. We strongly recommend upgrading to
the latest OpenWrt release and installing all available package updates.
Device support
No new devices were added in this security maintenance release.
Device fixes:
airoha: update the PCS driver to a newer proposed upstream version (EN7581 Ethernet SerDes)
ipq806x: Extreme Networks AP3935 - disable PHY hibernation on LAN1, which otherwise stayed dead when no cable was connected at power-on
WiFi fixes and improvements
mac80211: update the backported wireless stack and drivers from 6.12.61 to 6.12.96, containing many upstream fixes for ath10k, ath11k, rtw88, rtlwifi and iwlwifi, among them:
ath10k: skip WMI and beacon transmission when the device is wedged
ath11k: fix a warning on unbind and fix peer resolution on the RX path
rtw88: fix memory leaks on USB write failures
mac80211/nl80211: reject oversized EMA RNR lists and fix multi-link element defragmentation
hostapd / wpa_supplicant: multi-link (MLO) parsing validation fixes, see the security section above
wireless-regdb: update to 2026.05.30
Network and service improvements
odhcpd received many DHCPv6/DHCPv4 correctness and robustness fixes on top of the security fixes listed above, among them bounded nested relay recursion, correct handling of DHCPv4 Pad/End option encoding, fixed reallocation error handling and a memory leak on reload
odhcp6c: several fixes to DHCPv6 option parsing, RFC 6603 prefix-exclude handling, Reconfigure message validation and script invocation
rpcd: fixes for a use-after-free in the async exec reply path, a double close of exec pipe descriptors, an integer overflow in the UCI apply timeout and several memory leaks
umdns: update to a current version with the cache limits mentioned above
Other changes
busybox: the shell command history is now saved again. To avoid flash wear, it is written only when a shell session exits and it is stored in /tmp, so it is lost on reboot. The location can be changed in /etc/profile.d/busybox-history-file.sh.
Core components update
Linux kernel: update from 6.6.141 to 6.6.144
OpenSSL: update from 3.0.20 to 3.0.21 (multiple security fixes, see above)
dnsmasq: update from 2.90 to 2.93
mac80211: update from 6.12.61 to 6.12.96
wireless-regdb: update from 2026.03.18 to 2026.05.30
ca-certificates: update from 20260223 to 20260601 (refreshed root CA bundle)
Upgrading to 24.10
Sysupgrade can be used to upgrade a device from 23.05 to 24.10, and configuration will be preserved in most cases.
For for upgrades inside the OpenWrt 24.10 stable series for example from a OpenWrt 24.10 release candidate Attended Sysupgrade is supported in addition which allows preserving the installed packages too.
Sysupgrade from 22.03 to 24.10 is not officially supported.
There is no configuration migration path for users of the ipq806x target for Qualcomm Atheros IPQ806X SoCs because it switched to DSA. You have to upgrade without saving the configuration.
''Image version mismatch. image 1.1 device 1.0 Please wipe config during upgrade (force required) or reinstall. Config cannot be migrated from swconfig to DSA Image check failed''
User of the Linksys E8450 aka. Belkin RT3200 running OpenWrt 23.05 or earlier will need to run installer version v1.1.3 or later in order to reorganize the UBI layout for the 24.10 release. A detailed description is in the OpenWrt wiki. Updating without using the installer will break the device. Sysupgrade will show a warning before doing an incompatible upgrade.
Users of the Xiaomi AX3200 aka. Redmi AX6S running OpenWrt 23.05 or earlier have to follow a special upgrade procedure described in the wiki. This will increase the flash memory available for OpenWrt. Updating without following the guide in the wiki break the device. Sysupgrade will show a warning before doing an incompatible upgrade.
Users of Zyxel GS1900 series switches running OpenWrt 23.05 or earlier have to perform a new factory install with the initramfs image due to a changed partition layout. Sysupgrade will show a warning before doing an incompatible upgrade and is not possible. After upgrading, the config file /etc/config/system should not be restored from a backup, as this will overwrite the new compat_version value.
Users of scp from the dropbear package: recursive copies (scp -r) into an already existing target directory are now rejected. This is an intentional upstream change that comes with the fix for CVE-2019-6111. Use rsync or copy into a non-existing directory instead.
Known issues
LEDs for Airoha AN8855 are not yet supported. Devices like the Xiaomi AX3000T with an Airoha switch will have their switch LEDs powered off. This will not be addressed in the OpenWrt 24.10 series any more, it is fixed in OpenWrt 25.12.
5GHz WiFi is non-functional on certain devices with ath10k chipsets. Affected models include the Phicomm K2T, TP-Link Archer C60 v3 and possibly others. For details, see issue #14541.
Main changes between OpenWrt 25.12.4 and OpenWrt 25.12.5
Only the main changes are listed below. See the full changelog for details.
Security fixes
This release fixes several remotely triggerable vulnerabilities in core network services that are enabled by default. Updating is strongly recommended.
odhcpd (DHCPv6/DHCPv4/RA server, enabled by default): multiple vulnerabilities reachable by a network-adjacent attacker were fixed by updating odhcpd:
CVE-2026-53921 (Critical): stack buffer overflow in the DHCPv6 IA reply serialization, triggerable with crafted DHCPv6 REQUEST packets. GHSA-7fwx-hhrg-3496
CVE-2026-53918 (High): use-after-free in the DHCPv6 IA handler. GHSA-44ff-jcwh-wgc2
CVE-2026-53920 (High): stack memory disclosure via a truncated DHCPv6 IA_NA/IA_PD option. GHSA-p769-5v73-pc4f
CVE-2026-53922 (Moderate): pre-auth denial of service via a size_t underflow in DHCPv6 IA handling. GHSA-7hcw-g2jh-pqv5
CVE-2026-55606 (Moderate): stack buffer overread caused by a DUID length endianness mismatch. GHSA-x8x4-7gvf-gp45
No CVE assigned (Moderate, CVSS 5.4): the NDP relay accepted IPv6 Neighbor Solicitations with a hop limit other than 255 (RFC 4861 violation), letting an off-link attacker spoof NS packets through the relay (neighbor-cache poisoning, traffic redirection or DoS). Only relevant when the NDP relay is enabled. https://github.com/openwrt/odhcpd/security/advisories/GHSA-qvg7-9jf5-wgjc
odhcpd / LuCI stored XSS (Critical): an unauthenticated DHCPv6 client could inject lease-file lines through a crafted FQDN hostname, resulting in stored cross-site scripting on the LuCI DHCPv6 leases status page. Fixed by escaping client hostnames in the lease state file. GHSA-hhmc-92hw-535f
uhttpd (web server): three HTTP request smuggling issues on keep-alive connections were fixed:
CVE-2026-55612 (High): invalid chunk-length state reset. GHSA-p55c-rmhc-qfm5
CVE-2026-55613 (Moderate): ubus POST body parse-error desync. GHSA-wgwp-64hh-f52p
cgi-io: ACL bypass / arbitrary file read (Moderate): a path-traversal flaw in the cgi-download handler let an authenticated user with wildcard read permission read any root-readable file (e.g. /etc/shadow). GHSA-jw5r-xhf5-2xcq
LuCI (web interface): a set of issues in LuCI core modules and applications were fixed. Most let a logged-in user with limited (delegated) permissions escalate to root command execution; a few are stored XSS issues reachable by clients on the network. The privilege-escalation issues only apply if the affected app is installed and the account/ACL in question exists:
luci-app-tailscale-community (Critical, CVSS 9.9): command injection allowing delegated users to run commands as root via tailscale.do_login. GHSA-xwc5-mx58-rh35
luci-app-advanced-reboot (High): CVE-2026-55897 — a read ACL exposes /bin/sh via file.exec, allowing delegated users to run commands as root. GHSA-vj96-f37g-37f6
luci-app-adblock-fast (High): CVE-2026-55159 — delegated users can reach root command execution via newline-separated cron entries. GHSA-ggpf-xrph-wg5v
luci-app-samba4 (High): a read ACL allows authenticated root command execution via the smbd file.exec permission. GHSA-vx64-mmp7-h36c
luci-app-travelmate (High): a delegated UCI write can execute the travelmate auto-login command as root. GHSA-p35r-3323-6g7g
luci-app-upnp (High): stored XSS — an unauthenticated LAN client can inject JavaScript via a UPnP port-mapping description. GHSA-8v49-6387-7f89
luci-mod-network / luci-mod-status (High): stored XSS via a DHCPv6 lease hostname (FQDN) shown in the status tables. GHSA-686p-p8p9-x6fh
luci-app-banip (High): a crafted LuCI login username can inject an arbitrary IP into banIP's log parser, causing the wrong address to be blocked. GHSA-r6hx-4f83-vp8m
ead (Emergency Access Daemon): CVE-2026-55490 (Moderate): an integer underflow in handle_send_a() allowed a pre-auth denial of service. GHSA-9558-77jp-g3fw
Linux kernel: update to 6.12.94, pulling in the upstream 6.12.88 through 6.12.94 stable releases, which fix multiple security vulnerabilities, such as CVE-2026-43500.
dropbear (SSH): backport security fixes from upstream 2026.90 and 2026.91, including CVE-2019-6111 (a malicious server could trick the scp client into overwriting arbitrary local files) and CVE-2026-35385.
Beyond the issues listed above, this release fixes a number of further security problems for which no CVE number or dedicated advisory was assigned. We strongly recommend upgrading to the latest OpenWrt release and installing all available package updates.
Device support
New devices supported in 25.12.5:
ipq40xx: Linksys MR9000
mediatek (filogic): GL.iNET GL-MT3600BE
mediatek (filogic): Huasifei WH3000R (NAND)
mediatek (filogic): JioRouter AX6000 (JIDU6101)
mediatek (filogic): netis EAP930 V1
mediatek (filogic): netis MEX605
mediatek (filogic): TP-Link F65 v1
mediatek (filogic): Zbtlink ZBT-Z8106AX-S
mvebu: Zyxel NAS326
ramips (mt76x8): Cudy WR300 v1
ramips (mt7621): I-O DATA WN-AX2033GR2
New image variants for already supported devices:
mediatek (filogic): Qihoo 360T7 - add UBI layout image
mvebu: uDPU / eDPU - convert to dual (A/B) firmware
ipq806x: AP3935 - disable hibernation on LAN1
airoha (an7581): platform improvements and upstream networking fixes
WiFi fixes and improvements
wifi-scripts: fix a null dereference on 6 GHz-only radios
wifi-scripts: fix EAP (802.1X) station mode in the wpa_supplicant configuration generator
wifi-scripts: fix tracking of disabled virtual interfaces
hostapd: fix a misplaced radar-detected (DFS) ubus notification
Network and service improvements
New "network" LED trigger (lan/wan/wlan) for link and activity indication on supported devices
odhcpd and odhcp6c received many DHCPv6/DHCPv4 and IPv6 prefix-delegation correctness and robustness fixes, on top of the security fixes listed above, including more stable DHCPv6 IAID handling
More robust handling of invalid DHCP / DHCPv6 client identifiers
ubus, rpcd, uhttpd, umdns, uclient and fstools updated with stability and hardening fixes
Other changes
kmod-nf-nathelper-extra was split into individual per-protocol packages, so only the needed NAT helper modules have to be installed.
Matching the linker max-page-size to the target page size removes unnecessary padding, which can make many binaries - and thus the images - a bit smaller.
OpenWrt builds are now more reproducible.
Core component updates
Linux kernel: update from 6.12.87 to 6.12.94
OpenSSL: update from 3.5.6 to 3.5.7 (multiple security fixes, see above)
wireless-regdb: update from 2026.03.18 to 2026.05.30
dnsmasq: update from 2.91 to 2.93
ca-certificates: update from 20260223 to 20260601 (refreshed root CA bundle)
util-linux: update from 2.41.3 to 2.41.5
Upgrading to 25.12.5
Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.
For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.
Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.
Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. fc0c518
Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. cd8dcfe
TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).
Meraki MX60: Direct sysupgrade to 25.12.5 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.
Sitecom WLR-7100 (X7 AC1200): This device was moved from the ath79/generic target to the ath79/tiny target in OpenWrt 25.12.4. Users upgrading from 25.12.3 or earlier need to flash the new image from the ath79/tiny target (use sysupgrade -F).
Known issues
Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
Pixel 10 phones have problems connecting to WPA3-protected WiFi 6 APs. #21486
802.11r Fast Transition (FT) causes connection problems with some WiFi clients when WPA3 is used. #22200
SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. #22344
The OpenWrt community is proud to announce the newest stable release of the OpenWrt 24.10 stable series.
This release fixes several security issues, including security fixes in dnsmasq and the Linux kernel. We recommend everyone to upgrade.
The OpenWrt 24.10 series is in security maintenance (only security problems are fixed), with end of life (EoL) projected for September 2026. We recommend migrating to OpenWrt 25.12 before then.
Download firmware images using the OpenWrt Firmware Selector:
Main changes between OpenWrt 24.10.6 and OpenWrt 24.10.7
Only the main changes are listed below. See changelog-24.10.7 for the full changelog.
Security fixes
Linux kernel:
CVE-2026-43284 ("Dirty Frag"): local privilege escalation through the IPsec ESP code path. This only affects devices that use IPsec, i.e. that have kmod-ipsec / the esp4 or esp6 kernel modules loaded. Fixed by the Linux kernel update to 6.6.138.
CVE-2026-31431 ("Copy Fail"): in earlier releases this only affected users of the starfive target and users who had installed kmod-crypto-user. Fixed by the Linux kernel update to 6.6.137.
openssl: update to 3.0.20, fixing multiple security vulnerabilities
mbedtls: update to 3.6.6, fixing multiple security vulnerabilities
wolfssl: update to 5.9.1, fixing multiple security vulnerabilities
Device support
airoha: an7581: enable USB support
airoha: EN7581: fix PCIe initialization and add x2 lane (x2 link) support
airoha: add U-Boot support for EN7581/AN7583 boards
bcm53xx: align image names with the device-tree compatible (affects image selection in the Firmware Selector)
qualcommax: ipq807x: Linksys MX5300: fix MAC address labelling
ramips: mt7621: Xiaomi Mi Router AC2100: fix MAC address labelling
Various fixes and improvements
airoha: an7581: fix kernel panic in the I2S audio driver
airoha: fix Ethernet hardware offload on EN7581 (backported upstream airoha_eth patches, offload with GDM2 present)
lantiq: fix refcount and memory leak in the MTD partition parser
wifi-scripts: fix MAC address check in the mac80211 setup script
Core components update
Linux kernel: update from 6.6.127 to 6.6.141
ca-certificates: update from 20250419 to 20260223
mbedtls: update from 3.6.5 to 3.6.6
openssl: update from 3.0.19 to 3.0.20
wireless-regdb: update from 2026.02.04 to 2026.03.18
wolfssl: update from 5.7.6 to 5.9.1
Upgrading to 24.10
Sysupgrade can be used to upgrade a device from 23.05 to 24.10, and configuration will be preserved in most cases.
For for upgrades inside the OpenWrt 24.10 stable series for example from a OpenWrt 24.10 release candidate Attended Sysupgrade is supported in addition which allows preserving the installed packages too.
Sysupgrade from 22.03 to 24.10 is not officially supported.
There is no configuration migration path for users of the ipq806x target for Qualcomm Atheros IPQ806X SoCs because it switched to DSA. You have to upgrade without saving the configuration.
''Image version mismatch. image 1.1 device 1.0 Please wipe config during upgrade (force required) or reinstall. Config cannot be migrated from swconfig to DSA Image check failed''
User of the Linksys E8450 aka. Belkin RT3200 running OpenWrt 23.05 or earlier will need to run installer version v1.1.3 or later in order to reorganize the UBI layout for the 24.10 release. A detailed description is in the OpenWrt wiki. Updating without using the installer will break the device. Sysupgrade will show a warning before doing an incompatible upgrade.
Users of the Xiaomi AX3200 aka. Redmi AX6S running OpenWrt 23.05 or earlier have to follow a special upgrade procedure described in the wiki. This will increase the flash memory available for OpenWrt. Updating without following the guide in the wiki break the device. Sysupgrade will show a warning before doing an incompatible upgrade.
Users of Zyxel GS1900 series switches running OpenWrt 23.05 or earlier have to perform a new factory install with the initramfs image due to a changed partition layout. Sysupgrade will show a warning before doing an incompatible upgrade and is not possible. After upgrading, the config file /etc/config/system should not be restored from a backup, as this will overwrite the new compat_version value.
Known issues
LEDs for Airoha AN8855 are not yet supported. Devices like the Xiaomi AX3000T with an Airoha switch will have their switch LEDs powered off. This issue will be addressed in an upcoming OpenWrt SNAPSHOT and the OpenWrt 24.10 minor release.
5GHz WiFi is non-functional on certain devices with ath10k chipsets. Affected models include the Phicomm K2T, TP-Link Archer C60 v3 and possibly others. For details, see issue #14541.
CVE-2026-5172: buffer overflow in extract_addresses() on crafted resource records.
Linux kernel: CVE-2026-43284 ("Dirty Frag") — local privilege escalation via the IPsec ESP path. Only relevant on devices with kmod-ipsec / esp4/esp6 loaded. Fixed via the 6.12.87 kernel update.
ath79: Sitecom WLR-7100 (X7 AC1200): fix MAC address assignment, wire up 5 GHz WLAN LED, and move to the tiny target to free ~800 KiB of flash
ipq40xx: Pakedge WR-1: restore lost band label on the WLAN LEDs
mediatek: filogic: Cudy WR3000E/H/P/S v1 and WBR3000UAX v1 (ubootmod NAND builds): disable NMBM, which was mistakenly enabled and prevented the NAND from being used correctly
microchipsw: fix LAN8814 QSGMII soft reset
WiFi fixes and improvements
wifi-scripts: fix basic_rate mapping in the wpa_supplicant ucode generator
mac80211: update backports package to 6.18.26 (general stability improvements)
Core component updates
Linux kernel: update from 6.12.85 to 6.12.87
mac80211: update from 6.18.7 to 6.18.26
Upgrading to 25.12.4
Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.
For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.
Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.
Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. fc0c518
Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. cd8dcfe
TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).
Meraki MX60: Direct sysupgrade to 25.12.4 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.
Known issues
Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
Pixel 10 phones have problems connecting to WPA3-protected WiFi 6 APs. #21486
802.11r Fast Transition (FT) causes connection problems with some WiFi clients when WPA3 is used. #22200
SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. #22344
Main changes between OpenWrt 25.12.2 and OpenWrt 25.12.3
Only the main changes are listed below. See the full changelog for details.
Security fixes
Linux kernel: fixes CVE-2026-31431 ("Copy Fail"). In earlier releases this only affected users on the starfive target and users who had installed kmod-crypto-user.
mbedtls: update to 3.6.6 (multiple CVE fixes)
OpenSSL: update to 3.5.6 (multiple CVE fixes)
wolfSSL: update to 5.9.1 (multiple CVE fixes)
Device support
New devices supported in 25.12.3:
mediatek: filogic: ASUS RT-AX52 PRO
mediatek: filogic: D-Link AQUILA PRO AI E30
mediatek: filogic: Huasifei WH3000 Pro (NAND variant)
qualcommax: ipq50xx: Xiaomi AX6000: enable PCIe1 for QCA9887
qualcommax: ipq807x: Linksys MX5300: add label MAC assignment
ramips: Yuncore CPE200: fix EEPROM size
ramips: mt7621: fix reset hang
ramips: Wavlink WL-WN575A3: fix EEPROM size for 5 GHz WiFi
ramips: Xiaomi Mi Router 4C: fix WAN LED GPIO (#18578)
WiFi fixes and improvements
wifi-scripts: fix incorrect erp_domain and fils_cache_id values generated by the ucode-based config script (#21768)
wifi-scripts: add missing bridge_isolate and network_vlan fields to the ucode schema (#22620)
wifi-scripts: add missing iface and other fields to the ucode station/vlan schema (#22165)
wifi-scripts: add EHT (WiFi 7) rates to set_fixed_freq
Networking and system fixes
mbedtls: backport upstream patches to fix TLS 1.2 client issues — fixes a regression that broke DDNS updates and other TLS 1.2 client connections; the regression was introduced in mbedtls package updates shipped after the 25.12.2 release (#22874)
base-files: sysupgrade: fix -u option (skip default configuration) which was broken with apk
base-files: sysupgrade: fix -f (custom backup) when the path contains spaces
base-files: sysupgrade: update backup exclusion list
base-files: use DISKSEQ instead of MAJOR/MINOR for stable disk identification (MAJOR/MINOR are not sequential)
lantiq: fix mtdparsers refcount and memory leak
uqmi / umbim: introduce devpath option for selecting cellular modems by USB device path
kernel: add kmod-vsock and kmod-vsock-virtio for VM guests (vsock communication)
Core component updates
Linux kernel: update from 6.12.74 to 6.12.85
ca-certificates: update from 20250419 to 20260223
linux-firmware: update from 20251125 to 20260221
mbedtls: update from 3.6.5 to 3.6.6 (security fixes)
OpenSSL: update from 3.5.5 to 3.5.6 (security fixes)
wireless-regdb: update from 2026.02.04 to 2026.03.18
wolfSSL: update from 5.8.4 to 5.9.1 (security fixes)
xdp-tools: update from 1.4.3 to 1.6.3
Upgrading to 25.12.3
Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.
For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.
Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.
Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. fc0c518
Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. cd8dcfe
TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).
Meraki MX60: Direct sysupgrade to 25.12.3 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.
Known issues
Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
Pixel 10 phones have problems connecting to WPA3-protected WiFi 6 APs. #21486
802.11r Fast Transition (FT) causes connection problems with some WiFi clients when WPA3 is used. #22200
SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. #22344
Main changes between OpenWrt 25.12.1 and OpenWrt 25.12.2
Only the main changes are listed below. See the full changelog for details.
Device support
airoha: rename kernel module kmod-pwm-an7581 to kmod-pwm-airoha — users with this module explicitly installed need to reinstall under the new name
apm821xx: fix U-Boot environment definitions for NETGEAR WNDR4700, Western Digital MyBookLive, Meraki MR24 and Meraki MX60; fix PCIe boot failure on Meraki MX60
ath79: fix initramfs boot for Huawei AP5030DN and AP6010DN
ath79: fix VLAN CPU port tagging on 2-CPU-port devices (affects several dual-CPU switch configurations)
ath79: remove incorrectly included WiFi packages from Mikrotik RB750r2 (device has no WiFi hardware)
ipq40xx: fix ART partition name for Linksys Velop WHW03 V1 — restores correct WiFi calibration data access
ipq40xx: fix MAC address reading for Linksys devices using eMMC-based NVMEM
lantiq: xrx200: fix failsafe mode on BT HomeHub 5A — LAN ports 1 & 2 now work correctly in failsafe (#22480)
mediatek: Bananapi BPI-R4: fix SFP+ electric module support — modules that stopped working after a snapshot upgrade are now functional again (#19878)
ramips: fix kernel decompress error that bricked ELECOM WRC-X1800GS on 25.12.0 (#22270)
ramips: fix initramfs kernel load address for TP-Link EAP615-Wall v1
ramips: fix MAC address assignment for Xiaomi Mi AC2100
realtek: fix D-Link fan control script
WiFi fixes and improvements
wifi-scripts: fix 160 MHz channel width configuration — hostapd was not correctly configured for 160 MHz, preventing its use (#22481)
wifi-scripts: fix SU beamformee antenna count — incorrect count was passed to the driver
hostapd: fix memory leak in Radio Resource Management (RRM) ubus interface
mac80211: ath12k: add thermal sensor support for QCA/IPQ devices
mac80211: ath9k: fix GPIO mask handling from device tree
mt76: fix severe WiFi latency regression (up to multiple seconds) on 2.4 GHz introduced in 25.12.1 — affected many MediaTek devices including OpenWrt One, Zyxel EX5601, ASUS RT-AX53U, Xiaomi AX3000T/AX6000, Cudy WR3000/X6, GL Flint 2 and others (#22491)
mt76: multiple further stability fixes for MediaTek WiFi chipsets (MT7615/MT7915/MT7996/MT7992/MT792x):
add per-link beacon monitoring for MLO (Multi-Link Operation)
fix MT7996/MT7992 link handling during MLO station add/remove
fix scan work requeue race with spinlock
Upgrading to 25.12.2
Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.
For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.
Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.
Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. fc0c518
Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. cd8dcfe
TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).
Meraki MX60: Direct sysupgrade to 25.12.2 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.
Known issues
Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
Pixel 10 phones have problems connecting to WPA3-protected WiFi 6 APs. #21486
802.11r Fast Transition (FT) causes connection problems with some WiFi clients when WPA3 is used. #22200
SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. #22344
wireless-regdb: update from 2025.10.07 to 2026.02.04
OpenWrt 24.10 end of life
With the release of OpenWrt 25.12 stable series, the OpenWrt 24.10 stable series will go end of life in 6 months. We will not provide security updates for OpenWrt 24.10 after September 2026. We encourage everyone to upgrade to OpenWrt 25.12 before September 2026.
Upgrading to 24.10
Sysupgrade can be used to upgrade a device from 23.05 to 24.10, and configuration will be preserved in most cases.
For for upgrades inside the OpenWrt 24.10 stable series for example from a OpenWrt 24.10 release candidate Attended Sysupgrade is supported in addition which allows preserving the installed packages too.
Sysupgrade from 22.03 to 24.10 is not officially supported.
There is no configuration migration path for users of the ipq806x target for Qualcomm Atheros IPQ806X SoCs because it switched to DSA. You have to upgrade without saving the configuration.
''Image version mismatch. image 1.1 device 1.0 Please wipe config during upgrade (force required) or reinstall. Config cannot be migrated from swconfig to DSA Image check failed''
User of the Linksys E8450 aka. Belkin RT3200 running OpenWrt 23.05 or earlier will need to run installer version v1.1.3 or later in order to reorganize the UBI layout for the 24.10 release. A detailed description is in the OpenWrt wiki. Updating without using the installer will break the device. Sysupgrade will show a warning before doing an incompatible upgrade.
Users of the Xiaomi AX3200 aka. Redmi AX6S running OpenWrt 23.05 or earlier have to follow a special upgrade procedure described in the wiki. This will increase the flash memory available for OpenWrt. Updating without following the guide in the wiki break the device. Sysupgrade will show a warning before doing an incompatible upgrade.
Users of Zyxel GS1900 series switches running OpenWrt 23.05 or earlier have to perform a new factory install with the initramfs image due to a changed partition layout. Sysupgrade will show a warning before doing an incompatible upgrade and is not possible. After upgrading, the config file /etc/config/system should not be restored from a backup, as this will overwrite the new compat_version value.
Known issues
LEDs for Airoha AN8855 are not yet supported. Devices like the Xiaomi AX3000T with an Airoha switch will have their switch LEDs powered off. This issue will be addressed in an upcoming OpenWrt SNAPSHOT and the OpenWrt 24.10 minor release.
5GHz WiFi is non-functional on certain devices with ath10k chipsets. Affected models include the Phicomm K2T, TP-Link Archer C60 v3 and possibly others. For details, see issue #14541.
treewide: Linksys devices: fix MAC address assignment
WiFi fixes and improvements
mac80211: fix crash triggered by Channel Switch Announcement (CSA) when AP VLAN interfaces are in use
mt76: add MT7990 firmware support (new MediaTek WiFi 7 chipset)
mt76: mt7915: fix power save mode handling
mt76: mt7921/MT7902: add MT7902e MCU and DMA layout support
mt76: mt7996/mt7992: fix crash in transmit path, fix out-of-bounds access during hardware restart, improve MLO/CSA and radar detection support
wifi-scripts: fix incorrect VHT160 capability advertisement — was incorrectly set on non-160 MHz AP configurations, degrading station upload speed (#22435)
luci-mod-network: fix XSS vulnerability in WiFi scan modal (CVE-2026-32721)
ustream-ssl (OpenSSL variant): fix use-after-free crash causing uhttpd (the LuCI web server) to crash under high load (#19349)
Networking and system fixes
firewall4: set as the preferred firewall package over the legacy firewall package
iptables: prefer the nftables-backed variants (iptables-nft, ip6tables-nft) when iptables is pulled in as a dependency
kernel: CAKE QoS scheduler fixes — avoid unnecessary synchronization overhead when running without a rate limit, fix DiffServ rate scaling
kernel: SFP: improve Huawei MA5671a module support — module is now accessible even when no fiber is connected
odhcpd: fix segfault when disabling a DHCP interface, fix DHCPv4 lease tree corruption, fix truncated field in DHCPv6 lease queries, fix DNS search list padding
ppp: fix potential memory safety issue (undefined behavior in memcpy with overlapping buffers); remove the MRU limit patch for PPPoE connections (ppp-project/ppp#573)
Package manager (apk)
apk: update to version 3.0.5 with several OpenWrt-specific bug fixes
apk: add --force-reinstall option to reinstall already-installed packages without requiring a version change
Core component updates
apk: update from 3.0.2 to 3.0.5
jsonfilter: update from 2025-10-04 to 2026-03-16 (fixes CVE-2026-30873)
libubox: update from 2026-02-13 to 2026-03-13 (ABI version stabilized for 25.12 stable series)
Linux kernel: update from 6.12.71 to 6.12.74
odhcpd: update from 2026-01-19 to 2026-03-16
omcproxy: update from 2025-10-04 to 2026-03-07
procd: update from 2026-02-20 to 2026-03-14 (fixes CVE-2026-30874)
umdns: update from 2025-10-04 to 2026-02-06 (fixes CVE-2026-30871, CVE-2026-30872)
ustream-ssl: update from 2025-10-03 to 2026-03-01
Upgrading to 25.12.1
Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.
For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.
Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.
Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. fc0c518
Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. cd8dcfe
TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).
Known issues
Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
Pixel 10 phones have problems connecting to WPA3-protected WiFi 6 APs. #21486
802.11r Fast Transition (FT) causes connection problems with some WiFi clients when WPA3 is used. #22200
SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. #22344
160 MHz channel width cannot be configured. #22481
Log in
