Cyber Resilience Act Reporting Has Started and Yocto Kirkstone Is Out of Support: Check Your Products in 30 Minutes

A note to forward to your team

Cyber Resilience Act reporting and our Yocto base

Since 11 September 2026 we must send a 24-hour early warning and a 72-hour notification when a vulnerability in a product we sell in the European Union is actively exploited. Yocto Kirkstone has been out of support since April 2026.

Please run the four checks in this note for every product line by [date] and reply with three numbers:
1. Product lines that ship on Kirkstone or older
2. Shipped releases with a stored software bill of materials
3. Shipped releases without one

Reporting owner: [name]
Note: https://stonetusker.com/insights/cra-reporting-yocto-kirkstone.html

Why it matters now

The Cyber Resilience Act (Regulation (EU) 2024/2847) applies in stages.² Its reporting part has applied since 11 September 2026. An early warning is due within 24 hours, a full notification within 72 hours, and a final report no later than 14 days after a corrective measure is available (one month for a severe incident).¹ When a manufacturer first becomes aware of active exploitation after 11 September 2026, the duty applies, even if the vulnerability itself was known earlier.⁴

Consider a library such as OpenSSL reported as exploited on a Friday afternoon. Someone must know which shipped products and firmware versions contain it. If that answer needs a rebuild of an old tag, the 24 hours pass first.

An unsupported Yocto base makes the next part harder. Each fix means finding the upstream patch, backporting it, rebuilding, testing and shipping. The main obligations apply from 11 December 2027, including a support period of at least five years unless the expected use is shorter.^2,5

Check each product line in 30 minutes

Step 1. Find the Yocto release series

Open the build tree of the release that is currently shipping and run:

grep -r --include=layer.conf LAYERSERIES_CORENAMES .

The core layer names the series, for example kirkstone or scarthgap. If you use kas or repo manifests, the branch names in the manifest show the same information.

Step 2. Look for a stored software bill of materials

Open the release archive of the shipped firmware version and look for the software bill of materials that the build produced. Note whether it exists for every shipped release, or whether you would need a rebuild to produce one.

Step 3. Name the reporting owner

Write down who decides to send an early warning, and whether that person already has access to the Single Reporting Platform.

Step 4. Measure the update path

Write down how a fixed build reaches devices in the field, and how long that takes from merged fix to updated device.

What the result means

Release support dates come from the Yocto Project.⁶ Chip vendor board support packages often decide which release you can move to and when.

The move, step by step

1. Name the reporting owner. Decide who submits an early warning, arrange access to the Single Reporting Platform and write a one-page runbook.
2. Archive a software bill of materials for every shipped build. Enable generation in the build (create-spdx) and store the output with each release. Regenerate older releases still in the field once from their tags.
3. Monitor vulnerabilities daily. Check the stored records against public feeds, including the Known Exploited Vulnerabilities catalog of the United States Cybersecurity and Infrastructure Security Agency.
4. Decide the path for each Kirkstone product. Upgrade to Scarthgap or Wrynose, buy extended maintenance for a fixed period, or set an end-of-sale date, and record the decision with a date.
5. Rehearse against the clock. Take a real earlier vulnerability and run the whole process against 24 hours. Improve the slowest step first.

Wrynose makes SPDX 3.0 the only format for the software bill of materials it generates, which records build relationships and supports statements about which vulnerabilities do not affect you.⁷

What is still open

• The European Commission may still publish implementing acts and guidance, including on the format of the software bill of materials.
• National authorities are building their enforcement practice, so the first cases will clarify details.
• Chip vendors decide when board support packages for newer Yocto releases appear.