# OpenWrt: what changed from 24 to 25

- Product: OpenWrt (https://whatsnew.fyi/product/openwrt)
- Vendor: OpenWrt Project
- Range: changelog entries numbered after v24.10.8 up to and including v25.12.5, stable releases only
- Entries below: 6 releases (newest first)
- Resolved: 24 is v24.10.8 and 25 is v25.12.5, the newest stable release of each major we track
- Carrying security changes: 4 · CVEs mentioned: 44 · Mentioning breaking changes: 0 · Removing or deprecating something: 0
- Page: https://whatsnew.fyi/product/openwrt/compare/24...25

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (116 changes, grouped by kind)

### Added

#### v25.12.4 (2026-05-14)

- Add support for MikroTik RouterBOARD 960PGS (hEX PoE / PowerBox Pro) on ath79
- Add ubootmod variant for Cudy WR3000E v1 on mediatek filogic
- Add ubootmod variant for Cudy WR3000H v1 on mediatek filogic
- Add ubootmod variant for Cudy WR3000P v1 on mediatek filogic
- Add ubootmod variant for Cudy WR3000S v1 on mediatek filogic

#### v25.12.3 (2026-05-07)

- Support for ASUS RT-AX52 PRO on mediatek filogic
- Support for D-Link AQUILA PRO AI E30 on mediatek filogic
- Support for Huasifei WH3000 Pro (NAND variant) on mediatek filogic
- Support for Keenetic KAP-630 / Netcraze NAP-630 on mediatek filogic
- Support for Zbtlink ZBT-Z8106AX-T on mediatek filogic
- Support for Zyxel WX5600-T0 on mediatek filogic
- Support for EDUP EP-RT2983 on ramips mt7621
- Support for Cudy LT300 v3 on ramips mt76x8
- Support for DFI ADN553 on x86
- Support for DFI ASL553 on x86
- kmod-vsock and kmod-vsock-virtio for VM guests vsock communication

#### v25.12.2 (2026-03-27)

- Add thermal sensor support for QCA/IPQ devices in ath12k

#### v25.12.1 (2026-03-18)

- Enable device support for Devolo Magic 2 WiFi next on ipq40xx
- Re-enable MeshPoint.One target on ipq40xx
- Add support for Cudy M3000 with Motorcomm YT8821 PHY on mediatek

#### v25.12.0 (2026-03-05)

- Attended sysupgrade LuCI application installed by default
- owut included by default in images for devices with larger flash storage
- Shell command history is now preserved across sessions in a RAM-backed filesystem
- Integration of OpenWrt video feed with Qt5 and UI applications by default
- Added siflower target for Siflower SF21A6826/SF21H8898 SoCs
- Added sunxi/arm926ejs subtarget for Allwinner F1C100/200s SoCs
- Added microchipsw/lan969x target with support for Microchip LAN969x switches
- Support for over 180 new devices added, totaling over 2200 supported devices

### Changed

#### v25.12.5 (2026-07-01)

- Update Linux kernel to 6.12.94

#### v25.12.4 (2026-05-14)

- Update mac80211 backports package to 6.18.26 for general stability improvements
- Update Linux kernel from 6.12.85 to 6.12.87
- Update mac80211 from 6.18.7 to 6.18.26

#### v25.12.3 (2026-05-07)

- Linux kernel update from 6.12.74 to 6.12.85

#### v25.12.2 (2026-03-27)

- Rename kernel module kmod-pwm-an7581 to kmod-pwm-airoha for airoha devices

#### v25.12.0 (2026-03-05)

- Switch package manager from opkg to apk (Alpine Package Keeper)
- Wi-Fi scripts rewritten in ucode for improved performance and maintainability
- Extend realtek target with support for more switch SoCs including 10G Ethernet switches
- Extend qualcommax target with support for ipq50xx and ipq60xx SoCs
- Updated toolchain with musl libc 1.2.5, glibc 2.41, gcc 14.3.0, and binutils 2.44
- Updated Linux kernel to 6.12.71 for all targets
- Updated cfg80211/mac80211 from kernel 6.18.7
- Updated hostapd to master snapshot from August 2025
- Updated dnsmasq to 2.91
- Updated dropbear to 2025.89
- Updated busybox to 1.37.0

### Fixed

#### v25.12.4 (2026-05-14)

- Fix MAC address assignment for Sitecom WLR-7100 (X7 AC1200), wire up 5 GHz WLAN LED, and move to the tiny target to free approximately 800 KiB of flash
- Restore lost band label on the WLAN LEDs for Pakedge WR-1 on ipq40xx
- Disable NMBM for Cudy WR3000E/H/P/S v1 and WBR3000UAX v1 (ubootmod NAND builds) which was mistakenly enabled and prevented the NAND from being used correctly
- Fix LAN8814 QSGMII soft reset on microchipsw
- Fix basic_rate mapping in the wpa_supplicant ucode generator in wifi-scripts

#### v25.12.3 (2026-05-07)

- Netgear WNDAP360 sysupgrade, kernel loader, ethernet, LED, serial baud rate and U-Boot environment
- Bananapi BPI-R4 WiFi 7 module BE14 TX power via device tree overlay
- wifi-scripts incorrect erp_domain and fils_cache_id values
- wifi-scripts missing bridge_isolate and network_vlan fields in ucode schema
- mbedtls TLS 1.2 client regression that broke DDNS updates
- base-files sysupgrade -u option (skip default configuration)
- base-files sysupgrade -f option (custom backup) with paths containing spaces

#### v25.12.2 (2026-03-27)

- Fix U-Boot environment definitions for NETGEAR WNDR4700, Western Digital MyBookLive, Meraki MR24 and Meraki MX60
- Fix PCIe boot failure on Meraki MX60
- Fix initramfs boot for Huawei AP5030DN and AP6010DN
- Fix VLAN CPU port tagging on 2-CPU-port devices
- Remove incorrectly included WiFi packages from Mikrotik RB750r2
- Fix ART partition name for Linksys Velop WHW03 V1 to restore correct WiFi calibration data access
- Fix MAC address reading for Linksys devices using eMMC-based NVMEM
- Fix failsafe mode on BT HomeHub 5A with LAN ports 1 & 2 now working correctly in failsafe
- Fix SFP+ electric module support on Bananapi BPI-R4
- Fix kernel decompress error that bricked ELECOM WRC-X1800GS on 25.12.0
- Fix initramfs kernel load address for TP-Link EAP615-Wall v1
- Fix MAC address assignment for Xiaomi Mi AC2100
- Fix D-Link fan control script
- Fix 160 MHz channel width configuration in hostapd
- Fix SU beamformee antenna count passed to the driver
- Fix memory leak in Radio Resource Management (RRM) ubus interface in hostapd
- Fix GPIO mask handling from device tree in ath9k
- Fix severe WiFi latency regression on 2.4 GHz introduced in 25.12.1 affecting MediaTek devices

#### v25.12.1 (2026-03-18)

- Fix EN7581 PCIe initialization and add x2 link support on airoha devices
- Fix partition alignment on TP-Link RE355 v1 and RE450 v1/v2 to prevent configuration loss on sysupgrade
- Fix U-Boot NVMEM layout on ipq806x AP3935
- Fix GPIO expander clock on lantiq devices to restore correct LED and GPIO behaviour
- Fix missing WAN MAC address assignment on some lantiq devices
- Fix 10GbE PHY reset timing on TP-Link BE450 that caused intermittent boot stalls, add missing WLAN toggle button, fix reported memory size
- Fix swapped SFP I2C buses for ports 1 and 3 on Novarq Tactical 1000
- Fix sysupgrade functionality on Keenetic KN-1910
- Fix non-functional reboot on RTL838x-based switches

### Security

#### v25.12.5 (2026-07-01)

- Fix stack buffer overflow in odhcpd DHCPv6 IA reply serialization (CVE-2026-53921)
- Fix use-after-free in odhcpd DHCPv6 IA handler (CVE-2026-53918)
- Fix stack memory disclosure via truncated DHCPv6 IA_NA/IA_PD option in odhcpd (CVE-2026-53920)
- Fix pre-auth denial of service via size_t underflow in odhcpd DHCPv6 IA handling (CVE-2026-53922)
- Fix stack buffer overread caused by DUID length endianness mismatch in odhcpd (CVE-2026-55606)
- Fix NDP relay accepting IPv6 Neighbor Solicitations with hop limit other than 255 in odhcpd
- Fix stored cross-site scripting via DHCPv6 client FQDN hostname injection in odhcpd and LuCI
- Fix HTTP request smuggling via invalid chunk-length state reset in uhttpd (CVE-2026-55612)
- Fix HTTP request smuggling via case-sensitive Transfer-Encoding matching in uhttpd (CVE-2026-55614)
- Fix HTTP request smuggling via ubus POST body parse-error desync in uhttpd (CVE-2026-55613)
- Fix path-traversal in cgi-io download handler allowing arbitrary file read
- Fix command injection in luci-app-tailscale-community via tailscale.do_login
- Fix privilege escalation in luci-app-advanced-reboot via read ACL exposing /bin/sh (CVE-2026-55897)
- Fix privilege escalation in luci-app-adblock-fast via newline-separated cron entries (CVE-2026-55159)
- Fix privilege escalation in luci-app-samba4 via file.exec permission
- Fix privilege escalation in luci-app-travelmate via delegated UCI write executing auto-login command
- Fix stored cross-site scripting in luci-app-upnp via UPnP port-mapping description
- Fix stored cross-site scripting in luci-mod-network and luci-mod-status via DHCPv6 lease hostname
- Fix integer underflow in ead Emergency Access Daemon causing pre-auth denial of service (CVE-2026-55490)

#### v25.12.4 (2026-05-14)

- Backport six upstream CVE-fix patches to dnsmasq 2.91, including fixes for CVE-2026-2291 (heap buffer overflow in DNS domain-name handling), CVE-2026-4890 and CVE-2026-4891 (DNSSEC crashes), CVE-2026-4892 (buffer overflow on large DHCPv6 CLIDs), CVE-2026-4893 (broken EDNS Client Subnet validation), and CVE-2026-5172 (buffer overflow in extract_addresses)
- Fix CVE-2026-43284 (Dirty Frag) local privilege escalation via the IPsec ESP path through Linux kernel 6.12.87 update

#### v25.12.3 (2026-05-07)

- Linux kernel fixes CVE-2026-31431 (Copy Fail)
- mbedtls update to 3.6.6 with multiple CVE fixes
- OpenSSL update to 3.5.6 with multiple CVE fixes
- wolfSSL update to 5.9.1 with multiple CVE fixes

#### v25.12.1 (2026-03-18)

- Fix stack buffer overflow in umdns DNS PTR query handling (CVE-2026-30871)
- Fix stack buffer overflow in umdns IPv6 reverse DNS lookup (CVE-2026-30872)
- Fix memory leak in jsonpath when processing strings, labels, and regexp tokens (CVE-2026-30873)
- Fix command execution via PATH environment variable filter bypass in procd (CVE-2026-30874)
- Fix possible XSS attack via malicious SSID in LuCI WiFi scan modal (CVE-2026-32721)
- Fix stack buffer overflow in odhcpd DHCPv6 Identity Association logging
- Fix out-of-bounds write in procd cgroup path building and cgroup rule application

## Release notes

### v25.12.5

- Date: 2026-07-01
- Version: v25.12.5
- Original notes: https://github.com/openwrt/openwrt/releases/tag/v25.12.5
- Permalink: https://whatsnew.fyi/product/openwrt/releases/v25.12.5

- **security** — Fix stack buffer overflow in odhcpd DHCPv6 IA reply serialization (CVE-2026-53921)
- **security** — Fix use-after-free in odhcpd DHCPv6 IA handler (CVE-2026-53918)
- **security** — Fix stack memory disclosure via truncated DHCPv6 IA_NA/IA_PD option in odhcpd (CVE-2026-53920)
- **security** — Fix pre-auth denial of service via size_t underflow in odhcpd DHCPv6 IA handling (CVE-2026-53922)
- **security** — Fix stack buffer overread caused by DUID length endianness mismatch in odhcpd (CVE-2026-55606)
- **security** — Fix NDP relay accepting IPv6 Neighbor Solicitations with hop limit other than 255 in odhcpd
- **security** — Fix stored cross-site scripting via DHCPv6 client FQDN hostname injection in odhcpd and LuCI
- **security** — Fix HTTP request smuggling via invalid chunk-length state reset in uhttpd (CVE-2026-55612)
- **security** — Fix HTTP request smuggling via case-sensitive Transfer-Encoding matching in uhttpd (CVE-2026-55614)
- **security** — Fix HTTP request smuggling via ubus POST body parse-error desync in uhttpd (CVE-2026-55613)
- **security** — Fix path-traversal in cgi-io download handler allowing arbitrary file read
- **security** — Fix command injection in luci-app-tailscale-community via tailscale.do_login
- **security** — Fix privilege escalation in luci-app-advanced-reboot via read ACL exposing /bin/sh (CVE-2026-55897)
- **security** — Fix privilege escalation in luci-app-adblock-fast via newline-separated cron entries (CVE-2026-55159)
- **security** — Fix privilege escalation in luci-app-samba4 via file.exec permission
- **security** — Fix privilege escalation in luci-app-travelmate via delegated UCI write executing auto-login command
- **security** — Fix stored cross-site scripting in luci-app-upnp via UPnP port-mapping description
- **security** — Fix stored cross-site scripting in luci-mod-network and luci-mod-status via DHCPv6 lease hostname
- **security** — Fix integer underflow in ead Emergency Access Daemon causing pre-auth denial of service (CVE-2026-55490)
- **changed** — Update Linux kernel to 6.12.94

Hi,

The OpenWrt community is proud to announce the fifth service release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:
  * https://firmware-selector.openwrt.org/?version=25.12.5

Download firmware images directly from our download servers:
  * https://downloads.openwrt.org/releases/25.12.5/targets/


Main changes between OpenWrt 25.12.4 and OpenWrt 25.12.5
=========================================================

Only the main changes are listed below. See the [full changelog](https://openwrt.org/releases/25.12/changelog-25.12.5) for details.


Security fixes
==============

This release fixes several remotely triggerable vulnerabilities in core network services that are enabled by default. Updating is strongly recommended.

  * **odhcpd (DHCPv6/DHCPv4/RA server, enabled by default):** multiple vulnerabilities reachable by a network-adjacent attacker were fixed by updating odhcpd:
    * **CVE-2026-53921** (Critical): stack buffer overflow in the DHCPv6 IA reply serialization, triggerable with crafted DHCPv6 REQUEST packets. https://github.com/openwrt/odhcpd/security/advisories/GHSA-7fwx-hhrg-3496
    * **CVE-2026-53918** (High): use-after-free in the DHCPv6 IA handler. https://github.com/openwrt/odhcpd/security/advisories/GHSA-44ff-jcwh-wgc2
    * **CVE-2026-53920** (High): stack memory disclosure via a truncated DHCPv6 IA_NA/IA_PD option. https://github.com/openwrt/odhcpd/security/advisories/GHSA-p769-5v73-pc4f
    * **CVE-2026-53922** (Moderate): pre-auth denial of service via a size_t underflow in DHCPv6 IA handling. https://github.com/openwrt/odhcpd/security/advisories/GHSA-7hcw-g2jh-pqv5
    * **CVE-2026-55606** (Moderate): stack buffer overread caused by a DUID length endianness mismatch. https://github.com/openwrt/odhcpd/security/advisories/GHSA-x8x4-7gvf-gp45
    * **No CVE assigned** (Moderate, CVSS 5.4): the NDP relay accepted IPv6 Neighbor Solicitations with a hop limit other than 255 (RFC 4861 violation), letting an off-link attacker spoof NS packets through the relay (neighbor-cache poisoning, traffic redirection or DoS). Only relevant when the NDP relay is enabled. https://github.com/openwrt/odhcpd/security/advisories/GHSA-qvg7-9jf5-wgjc
  * **odhcpd / LuCI stored XSS** (Critical): an unauthenticated DHCPv6 client could inject lease-file lines through a crafted FQDN hostname, resulting in stored cross-site scripting on the LuCI DHCPv6 leases status page. Fixed by escaping client hostnames in the lease state file. https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535f
  * **uhttpd (web server):** three HTTP request smuggling issues on keep-alive connections were fixed:
    * **CVE-2026-55612** (High): invalid chunk-length state reset. https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5
    * **CVE-2026-55614** (High): case-sensitive Transfer-Encoding matching. https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf
    * **CVE-2026-55613** (Moderate): ubus POST body parse-error desync. https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p
  * **cgi-io: ACL bypass / arbitrary file read** (Moderate): a path-traversal flaw in the cgi-download handler let an authenticated user with wildcard read permission read any root-readable file (e.g. `/etc/shadow`). https://github.com/openwrt/openwrt/security/advisories/GHSA-jw5r-xhf5-2xcq
  * **LuCI (web interface):** a set of issues in LuCI core modules and applications were fixed. Most let a logged-in user with limited (delegated) permissions escalate to root command execution; a few are stored XSS issues reachable by clients on the network. The privilege-escalation issues only apply if the affected app is installed and the account/ACL in question exists:
    * **luci-app-tailscale-community** (Critical, CVSS 9.9): command injection allowing delegated users to run commands as root via `tailscale.do_login`. h

_[Truncated at 4000 characters — full notes: https://github.com/openwrt/openwrt/releases/tag/v25.12.5]_

### v25.12.4

- Date: 2026-05-14
- Version: v25.12.4
- Original notes: https://github.com/openwrt/openwrt/releases/tag/v25.12.4
- Permalink: https://whatsnew.fyi/product/openwrt/releases/v25.12.4

- **security** — Backport six upstream CVE-fix patches to dnsmasq 2.91, including fixes for CVE-2026-2291 (heap buffer overflow in DNS domain-name handling), CVE-2026-4890 and CVE-2026-4891 (DNSSEC crashes), CVE-2026-4892 (buffer overflow on large DHCPv6 CLIDs), CVE-2026-4893 (broken EDNS Client Subnet validation), and CVE-2026-5172 (buffer overflow in extract_addresses)
- **security** — Fix CVE-2026-43284 (Dirty Frag) local privilege escalation via the IPsec ESP path through Linux kernel 6.12.87 update
- **added** — Add support for MikroTik RouterBOARD 960PGS (hEX PoE / PowerBox Pro) on ath79
- **added** — Add ubootmod variant for Cudy WR3000E v1 on mediatek filogic
- **added** — Add ubootmod variant for Cudy WR3000H v1 on mediatek filogic
- **added** — Add ubootmod variant for Cudy WR3000P v1 on mediatek filogic
- **added** — Add ubootmod variant for Cudy WR3000S v1 on mediatek filogic
- **fixed** — Fix MAC address assignment for Sitecom WLR-7100 (X7 AC1200), wire up 5 GHz WLAN LED, and move to the tiny target to free approximately 800 KiB of flash
- **fixed** — Restore lost band label on the WLAN LEDs for Pakedge WR-1 on ipq40xx
- **fixed** — Disable NMBM for Cudy WR3000E/H/P/S v1 and WBR3000UAX v1 (ubootmod NAND builds) which was mistakenly enabled and prevented the NAND from being used correctly
- **fixed** — Fix LAN8814 QSGMII soft reset on microchipsw
- **fixed** — Fix basic_rate mapping in the wpa_supplicant ucode generator in wifi-scripts
- **changed** — Update mac80211 backports package to 6.18.26 for general stability improvements
- **changed** — Update Linux kernel from 6.12.85 to 6.12.87
- **changed** — Update mac80211 from 6.18.7 to 6.18.26

Hi,

The OpenWrt community is proud to announce the fourth service release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:
  * https://firmware-selector.openwrt.org/?version=25.12.4

Download firmware images directly from our download servers:
  * https://downloads.openwrt.org/releases/25.12.4/targets/


Main changes between OpenWrt 25.12.3 and OpenWrt 25.12.4
=========================================================

Only the main changes are listed below. See the [full changelog](https://openwrt.org/releases/25.12/changelog-25.12.4) for details.


Security fixes
==============

  * **dnsmasq:** backport six upstream CVE-fix patches to dnsmasq 2.91:
    * CVE-2026-2291: heap buffer overflow in DNS domain-name handling.
    * CVE-2026-4890 / CVE-2026-4891: DNSSEC crashes via crafted NSEC bitmaps / RRSIG packets.
    * CVE-2026-4892: buffer overflow on large DHCPv6 CLIDs (only with `--dhcp-script`).
    * CVE-2026-4893: broken EDNS Client Subnet validation.
    * CVE-2026-5172: buffer overflow in `extract_addresses()` on crafted resource records.
  * **Linux kernel: CVE-2026-43284 ("Dirty Frag")** — local privilege escalation via the IPsec ESP path. Only relevant on devices with `kmod-ipsec` / `esp4`/`esp6` loaded. Fixed via the 6.12.87 kernel update.


Device support
==============

New devices supported in 25.12.4:
  * ath79: MikroTik RouterBOARD 960PGS (hEX PoE / PowerBox Pro)
  * mediatek: filogic: Cudy WR3000E v1: add ubootmod variant
  * mediatek: filogic: Cudy WR3000H v1: add ubootmod variant
  * mediatek: filogic: Cudy WR3000P v1: add ubootmod variant
  * mediatek: filogic: Cudy WR3000S v1: add ubootmod variant

Device fixes:
  * ath79: Sitecom WLR-7100 (X7 AC1200): fix MAC address assignment, wire up 5 GHz WLAN LED, and move to the `tiny` target to free ~800 KiB of flash
  * ipq40xx: Pakedge WR-1: restore lost band label on the WLAN LEDs
  * mediatek: filogic: Cudy WR3000E/H/P/S v1 and WBR3000UAX v1 (ubootmod NAND builds): disable NMBM, which was mistakenly enabled and prevented the NAND from being used correctly
  * microchipsw: fix LAN8814 QSGMII soft reset


WiFi fixes and improvements
============================

  * wifi-scripts: fix `basic_rate` mapping in the wpa_supplicant ucode generator
  * mac80211: update backports package to 6.18.26 (general stability improvements)


Core component updates
=======================

  * Linux kernel: update from 6.12.85 to 6.12.87
  * mac80211: update from 6.18.7 to 6.18.26


Upgrading to 25.12.4
=====================

Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.
For upgrades within the OpenWrt 25.12 stable series, [Attended Sysupgrade](https://openwrt.org/docs/guide-user/installation/attended.sysupgrade) is also supported, which allows preserving the installed packages.

 * Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.

 * Cron log level was fixed in busybox. `system.@system[0].cronloglevel` should be set to `7` for normal logging. `7` is the default now. If this option is not set, the default is used and no manual action is needed. https://github.com/openwrt/openwrt/commit/fc0c518a88e68d3deef04bec73b33d35186d6546

 * Bananapi BPI-R4: Interface `eth1` was renamed to `sfp-lan` or `lan4`, and interface `eth2` was renamed to `sfp-wan` to match the labels. You have to upgrade without saving the configuration. https://github.com/openwrt/openwrt/commit/cd8dcfef378044a1687adfa3738f01f9a9622baf

 * **TP-Link RE355 v1, RE450 v1 and RE450 v2:** The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use `sysupgrade -F` to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).

_[Truncated at 4000 characters — full notes: https://github.com/openwrt/openwrt/releases/tag/v25.12.4]_

### v25.12.3

- Date: 2026-05-07
- Version: v25.12.3
- Original notes: https://github.com/openwrt/openwrt/releases/tag/v25.12.3
- Permalink: https://whatsnew.fyi/product/openwrt/releases/v25.12.3

- **security** — Linux kernel fixes CVE-2026-31431 (Copy Fail)
- **security** — mbedtls update to 3.6.6 with multiple CVE fixes
- **security** — OpenSSL update to 3.5.6 with multiple CVE fixes
- **security** — wolfSSL update to 5.9.1 with multiple CVE fixes
- **added** — Support for ASUS RT-AX52 PRO on mediatek filogic
- **added** — Support for D-Link AQUILA PRO AI E30 on mediatek filogic
- **added** — Support for Huasifei WH3000 Pro (NAND variant) on mediatek filogic
- **added** — Support for Keenetic KAP-630 / Netcraze NAP-630 on mediatek filogic
- **added** — Support for Zbtlink ZBT-Z8106AX-T on mediatek filogic
- **added** — Support for Zyxel WX5600-T0 on mediatek filogic
- **added** — Support for EDUP EP-RT2983 on ramips mt7621
- **added** — Support for Cudy LT300 v3 on ramips mt76x8
- **added** — Support for DFI ADN553 on x86
- **added** — Support for DFI ASL553 on x86
- **added** — kmod-vsock and kmod-vsock-virtio for VM guests vsock communication
- **fixed** — Netgear WNDAP360 sysupgrade, kernel loader, ethernet, LED, serial baud rate and U-Boot environment
- **fixed** — Bananapi BPI-R4 WiFi 7 module BE14 TX power via device tree overlay
- **fixed** — wifi-scripts incorrect erp_domain and fils_cache_id values
- **fixed** — wifi-scripts missing bridge_isolate and network_vlan fields in ucode schema
- **fixed** — mbedtls TLS 1.2 client regression that broke DDNS updates
- **fixed** — base-files sysupgrade -u option (skip default configuration)
- **fixed** — base-files sysupgrade -f option (custom backup) with paths containing spaces
- **changed** — Linux kernel update from 6.12.74 to 6.12.85

Hi,

The OpenWrt community is proud to announce the third service release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:
  * https://firmware-selector.openwrt.org/?version=25.12.3

Download firmware images directly from our download servers:
  * https://downloads.openwrt.org/releases/25.12.3/targets/


Main changes between OpenWrt 25.12.2 and OpenWrt 25.12.3
=========================================================

Only the main changes are listed below. See the [full changelog](https://openwrt.org/releases/25.12/changelog-25.12.3) for details.


Security fixes
==============

  * Linux kernel: fixes **CVE-2026-31431 ("Copy Fail")**. In earlier releases this only affected users on the starfive target and users who had installed kmod-crypto-user.
  * mbedtls: update to 3.6.6 (multiple CVE fixes)
  * OpenSSL: update to 3.5.6 (multiple CVE fixes)
  * wolfSSL: update to 5.9.1 (multiple CVE fixes)


Device support
==============

New devices supported in 25.12.3:
  * mediatek: filogic: ASUS RT-AX52 PRO
  * mediatek: filogic: D-Link AQUILA PRO AI E30
  * mediatek: filogic: Huasifei WH3000 Pro (NAND variant)
  * mediatek: filogic: Keenetic KAP-630 / Netcraze NAP-630
  * mediatek: filogic: Zbtlink ZBT-Z8106AX-T
  * mediatek: filogic: Zyxel WX5600-T0
  * ramips: mt7621: EDUP EP-RT2983
  * ramips: mt76x8: Cudy LT300 v3
  * x86: DFI ADN553
  * x86: DFI ASL553

Device fixes:
  * ath79: Netgear WNDAP360: multiple fixes restoring proper operation (sysupgrade, kernel loader, ethernet, LED, serial baud rate and U-Boot environment)
  * ath79: Extreme Networks WS-AP3805i: fix U-Boot environment configuration
  * ath79: Mikrotik: fix included device packages
  * ipq50xx: Linksys MX5500: add label MAC device assignment
  * lantiq: Netgear DGN3500: fix U-Boot environment size — device was broken on 25.12 (https://github.com/openwrt/openwrt/issues/22692)
  * mediatek: filogic: Bananapi BPI-R4: add device tree overlay for the BE14 WiFi 7 module — fixes very low WiFi TX power on this module (https://github.com/openwrt/openwrt/issues/17489)
  * mediatek: filogic: Keenetic KN-1812: various Ethernet PHY device tree fixes (PHY reset, interrupt support, MDIO drive strength, partition naming, xsphy node)
  * mediatek: filogic: Netgear EAX17: fix rootfs hash in FIT node for per-device rootfs builds
  * mediatek: filogic: CMCC RAX3000M: add Airoha AN8855 switch support (https://github.com/openwrt/openwrt/issues/21230)
  * mediatek: filogic: Zbtlink ZBT-Z8103AX-D: enable NMBM on the SPI-NAND flash
  * mvebu: ClearFog Base/Pro: fix switch kernel module
  * qualcommax: ipq50xx: Xiaomi AX6000: enable PCIe1 for QCA9887
  * qualcommax: ipq807x: Linksys MX5300: add label MAC assignment
  * ramips: Yuncore CPE200: fix EEPROM size
  * ramips: mt7621: fix reset hang
  * ramips: Wavlink WL-WN575A3: fix EEPROM size for 5 GHz WiFi
  * ramips: Xiaomi Mi Router 4C: fix WAN LED GPIO (https://github.com/openwrt/openwrt/issues/18578)


WiFi fixes and improvements
============================

  * wifi-scripts: fix incorrect `erp_domain` and `fils_cache_id` values generated by the ucode-based config script (https://github.com/openwrt/openwrt/issues/21768)
  * wifi-scripts: add missing `bridge_isolate` and `network_vlan` fields to the ucode schema (https://github.com/openwrt/openwrt/issues/22620)
  * wifi-scripts: add missing `iface` and other fields to the ucode station/vlan schema (https://github.com/openwrt/openwrt/issues/22165)
  * wifi-scripts: add EHT (WiFi 7) rates to `set_fixed_freq`


Networking and system fixes
============================

  * mbedtls: backport upstream patches to fix TLS 1.2 client issues — fixes a regression that broke DDNS updates and other TLS 1.2 client connections; the regression was introduced in mbedtls package updates shipped after the 25.12.2 release (https://github.com/openwrt/openwrt/issues/22874)
  * base-files:

_[Truncated at 4000 characters — full notes: https://github.com/openwrt/openwrt/releases/tag/v25.12.3]_

### v25.12.2

- Date: 2026-03-27
- Version: v25.12.2
- Original notes: https://github.com/openwrt/openwrt/releases/tag/v25.12.2
- Permalink: https://whatsnew.fyi/product/openwrt/releases/v25.12.2

- **changed** — Rename kernel module kmod-pwm-an7581 to kmod-pwm-airoha for airoha devices
- **fixed** — Fix U-Boot environment definitions for NETGEAR WNDR4700, Western Digital MyBookLive, Meraki MR24 and Meraki MX60
- **fixed** — Fix PCIe boot failure on Meraki MX60
- **fixed** — Fix initramfs boot for Huawei AP5030DN and AP6010DN
- **fixed** — Fix VLAN CPU port tagging on 2-CPU-port devices
- **fixed** — Remove incorrectly included WiFi packages from Mikrotik RB750r2
- **fixed** — Fix ART partition name for Linksys Velop WHW03 V1 to restore correct WiFi calibration data access
- **fixed** — Fix MAC address reading for Linksys devices using eMMC-based NVMEM
- **fixed** — Fix failsafe mode on BT HomeHub 5A with LAN ports 1 & 2 now working correctly in failsafe
- **fixed** — Fix SFP+ electric module support on Bananapi BPI-R4
- **fixed** — Fix kernel decompress error that bricked ELECOM WRC-X1800GS on 25.12.0
- **fixed** — Fix initramfs kernel load address for TP-Link EAP615-Wall v1
- **fixed** — Fix MAC address assignment for Xiaomi Mi AC2100
- **fixed** — Fix D-Link fan control script
- **fixed** — Fix 160 MHz channel width configuration in hostapd
- **fixed** — Fix SU beamformee antenna count passed to the driver
- **fixed** — Fix memory leak in Radio Resource Management (RRM) ubus interface in hostapd
- **added** — Add thermal sensor support for QCA/IPQ devices in ath12k
- **fixed** — Fix GPIO mask handling from device tree in ath9k
- **fixed** — Fix severe WiFi latency regression on 2.4 GHz introduced in 25.12.1 affecting MediaTek devices

Hi,

The OpenWrt community is proud to announce the second service release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:
  * https://firmware-selector.openwrt.org/?version=25.12.2

Download firmware images directly from our download servers:
  * https://downloads.openwrt.org/releases/25.12.2/targets/


Main changes between OpenWrt 25.12.1 and OpenWrt 25.12.2
=========================================================

Only the main changes are listed below. See the [full changelog](https://openwrt.org/releases/25.12/changelog-25.12.2) for details.


Device support
==============

  * airoha: rename kernel module `kmod-pwm-an7581` to `kmod-pwm-airoha` — users with this module explicitly installed need to reinstall under the new name
  * apm821xx: fix U-Boot environment definitions for NETGEAR WNDR4700, Western Digital MyBookLive, Meraki MR24 and Meraki MX60; fix PCIe boot failure on Meraki MX60
  * ath79: fix initramfs boot for Huawei AP5030DN and AP6010DN
  * ath79: fix VLAN CPU port tagging on 2-CPU-port devices (affects several dual-CPU switch configurations)
  * ath79: remove incorrectly included WiFi packages from Mikrotik RB750r2 (device has no WiFi hardware)
  * ipq40xx: fix ART partition name for Linksys Velop WHW03 V1 — restores correct WiFi calibration data access
  * ipq40xx: fix MAC address reading for Linksys devices using eMMC-based NVMEM
  * lantiq: xrx200: fix failsafe mode on BT HomeHub 5A — LAN ports 1 & 2 now work correctly in failsafe (https://github.com/openwrt/openwrt/issues/22480)
  * mediatek: Bananapi BPI-R4: fix SFP+ electric module support — modules that stopped working after a snapshot upgrade are now functional again (https://github.com/openwrt/openwrt/issues/19878)
  * ramips: fix kernel decompress error that bricked ELECOM WRC-X1800GS on 25.12.0 (https://github.com/openwrt/openwrt/issues/22270)
  * ramips: fix initramfs kernel load address for TP-Link EAP615-Wall v1
  * ramips: fix MAC address assignment for Xiaomi Mi AC2100
  * realtek: fix D-Link fan control script


WiFi fixes and improvements
============================

  * wifi-scripts: fix 160 MHz channel width configuration — hostapd was not correctly configured for 160 MHz, preventing its use (https://github.com/openwrt/openwrt/issues/22481)
  * wifi-scripts: fix SU beamformee antenna count — incorrect count was passed to the driver
  * hostapd: fix memory leak in Radio Resource Management (RRM) ubus interface
  * mac80211: ath12k: add thermal sensor support for QCA/IPQ devices
  * mac80211: ath9k: fix GPIO mask handling from device tree
  * mt76: fix severe WiFi latency regression (up to multiple seconds) on 2.4 GHz introduced in 25.12.1 — affected many MediaTek devices including OpenWrt One, Zyxel EX5601, ASUS RT-AX53U, Xiaomi AX3000T/AX6000, Cudy WR3000/X6, GL Flint 2 and others (https://github.com/openwrt/openwrt/issues/22491)
  * mt76: multiple further stability fixes for MediaTek WiFi chipsets (MT7615/MT7915/MT7996/MT7992/MT792x):
    * add per-link beacon monitoring for MLO (Multi-Link Operation)
    * fix MT7996/MT7992 link handling during MLO station add/remove
    * fix scan work requeue race with spinlock


Upgrading to 25.12.2
=====================

Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.
For upgrades within the OpenWrt 25.12 stable series, [Attended Sysupgrade](https://openwrt.org/docs/guide-user/installation/attended.sysupgrade) is also supported, which allows preserving the installed packages.

 * Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.

 * Cron log level was fixed in busybox. `system.@system[0].cronloglevel` should be set to `7` for normal logging. `7` is the default now. If this option is not set, the default is used and no ma

_[Truncated at 4000 characters — full notes: https://github.com/openwrt/openwrt/releases/tag/v25.12.2]_

### v25.12.1

- Date: 2026-03-18
- Version: v25.12.1
- Original notes: https://github.com/openwrt/openwrt/releases/tag/v25.12.1
- Permalink: https://whatsnew.fyi/product/openwrt/releases/v25.12.1

- **security** — Fix stack buffer overflow in umdns DNS PTR query handling (CVE-2026-30871)
- **security** — Fix stack buffer overflow in umdns IPv6 reverse DNS lookup (CVE-2026-30872)
- **security** — Fix memory leak in jsonpath when processing strings, labels, and regexp tokens (CVE-2026-30873)
- **security** — Fix command execution via PATH environment variable filter bypass in procd (CVE-2026-30874)
- **security** — Fix possible XSS attack via malicious SSID in LuCI WiFi scan modal (CVE-2026-32721)
- **security** — Fix stack buffer overflow in odhcpd DHCPv6 Identity Association logging
- **security** — Fix out-of-bounds write in procd cgroup path building and cgroup rule application
- **fixed** — Fix EN7581 PCIe initialization and add x2 link support on airoha devices
- **fixed** — Fix partition alignment on TP-Link RE355 v1 and RE450 v1/v2 to prevent configuration loss on sysupgrade
- **added** — Enable device support for Devolo Magic 2 WiFi next on ipq40xx
- **added** — Re-enable MeshPoint.One target on ipq40xx
- **fixed** — Fix U-Boot NVMEM layout on ipq806x AP3935
- **fixed** — Fix GPIO expander clock on lantiq devices to restore correct LED and GPIO behaviour
- **fixed** — Fix missing WAN MAC address assignment on some lantiq devices
- **added** — Add support for Cudy M3000 with Motorcomm YT8821 PHY on mediatek
- **fixed** — Fix 10GbE PHY reset timing on TP-Link BE450 that caused intermittent boot stalls, add missing WLAN toggle button, fix reported memory size
- **fixed** — Fix swapped SFP I2C buses for ports 1 and 3 on Novarq Tactical 1000
- **fixed** — Fix sysupgrade functionality on Keenetic KN-1910
- **fixed** — Fix non-functional reboot on RTL838x-based switches

Hi,

The OpenWrt community is proud to announce the first service release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:
  * https://firmware-selector.openwrt.org/?version=25.12.1

Download firmware images directly from our download servers:
  * https://downloads.openwrt.org/releases/25.12.1/targets/


Main changes between OpenWrt 25.12.0 and OpenWrt 25.12.1
=========================================================

Only the main changes are listed below. See the [full changelog](https://openwrt.org/releases/25.12/changelog-25.12.1) for details.


Security fixes
==============

OpenWrt components (Trail of Bits audit, February 2026):
  * CVE-2026-30871: Stack buffer overflow in umdns DNS PTR query handling (HIGH)
  * CVE-2026-30872: Stack buffer overflow in umdns IPv6 reverse DNS lookup (HIGH)
  * CVE-2026-30873: Memory leak in jsonpath when processing strings, labels, and regexp tokens (LOW)
  * CVE-2026-30874: Command execution via PATH environment variable filter bypass in procd (LOW)

LuCI:
  * CVE-2026-32721: Possible XSS attack via malicious SSID in LuCI WiFi scan modal (HIGH)

Additional hardening from the same Trail of Bits audit (no CVE assigned):
  * odhcpd: fix stack buffer overflow in DHCPv6 Identity Association logging
  * procd: fix out-of-bounds write in cgroup path building and cgroup rule application


Device support
==============

  * airoha: fix EN7581 PCIe initialization and add x2 (2-lane) link support — improves PCIe reliability and unlocks full bandwidth for affected devices
  * ath79: TP-Link RE355 v1, RE450 v1/v2: fix partition alignment to prevent configuration loss on sysupgrade
  * ipq40xx: Devolo Magic 2 WiFi next: enable device support
  * ipq40xx: re-enable MeshPoint.One target
  * ipq806x: AP3935: fix U-Boot NVMEM layout
  * lantiq: fix GPIO expander clock (gpio-stp-xway) — restores correct LED and GPIO behaviour on affected devices
  * lantiq: fix missing WAN MAC address assignment on some devices
  * mediatek: Cudy M3000: add support for hardware variant with Motorcomm YT8821 PHY (previously only the Realtek PHY variant was supported)
  * mediatek: TP-Link BE450: fix 10GbE PHY reset timing that caused intermittent boot stalls, add missing WLAN toggle button, fix reported memory size
  * microchipsw: Novarq Tactical 1000: fix swapped SFP I2C buses for ports 1 and 3 — fixes SFP EEPROM read failures
  * ramips: Keenetic KN-1910: fix sysupgrade functionality
  * realtek: RTL838x-based switches: fix non-functional reboot
  * treewide: Linksys devices: fix MAC address assignment


WiFi fixes and improvements
============================

  * mac80211: fix crash triggered by Channel Switch Announcement (CSA) when AP VLAN interfaces are in use
  * mt76: add MT7990 firmware support (new MediaTek WiFi 7 chipset)
  * mt76: mt7915: fix power save mode handling
  * mt76: mt7921/MT7902: add MT7902e MCU and DMA layout support
  * mt76: mt7996/mt7992: fix crash in transmit path, fix out-of-bounds access during hardware restart, improve MLO/CSA and radar detection support
  * wifi-scripts: fix incorrect VHT160 capability advertisement — was incorrectly set on non-160 MHz AP configurations, degrading station upload speed (https://github.com/openwrt/openwrt/issues/22435)
  * wifi-scripts: fix malformed wpa_supplicant config when 802.1X EAP credentials (identity, password, certificates) contain spaces (https://github.com/openwrt/openwrt/issues/22212)


Web interface (LuCI) and system fixes
======================================

  * luci-mod-network: fix XSS vulnerability in WiFi scan modal (CVE-2026-32721)
  * ustream-ssl (OpenSSL variant): fix use-after-free crash causing uhttpd (the LuCI web server) to crash under high load (https://github.com/openwrt/openwrt/issues/19349)


Networking and system fixes
============================

  * firewall4: set as the preferred firewall package o

_[Truncated at 4000 characters — full notes: https://github.com/openwrt/openwrt/releases/tag/v25.12.1]_

### v25.12.0

- Date: 2026-03-05
- Version: v25.12.0
- Original notes: https://github.com/openwrt/openwrt/releases/tag/v25.12.0
- Permalink: https://whatsnew.fyi/product/openwrt/releases/v25.12.0

- **changed** — Switch package manager from opkg to apk (Alpine Package Keeper)
- **added** — Attended sysupgrade LuCI application installed by default
- **added** — owut included by default in images for devices with larger flash storage
- **added** — Shell command history is now preserved across sessions in a RAM-backed filesystem
- **added** — Integration of OpenWrt video feed with Qt5 and UI applications by default
- **changed** — Wi-Fi scripts rewritten in ucode for improved performance and maintainability
- **changed** — Extend realtek target with support for more switch SoCs including 10G Ethernet switches
- **changed** — Extend qualcommax target with support for ipq50xx and ipq60xx SoCs
- **added** — Added siflower target for Siflower SF21A6826/SF21H8898 SoCs
- **added** — Added sunxi/arm926ejs subtarget for Allwinner F1C100/200s SoCs
- **added** — Added microchipsw/lan969x target with support for Microchip LAN969x switches
- **added** — Support for over 180 new devices added, totaling over 2200 supported devices
- **changed** — Updated toolchain with musl libc 1.2.5, glibc 2.41, gcc 14.3.0, and binutils 2.44
- **changed** — Updated Linux kernel to 6.12.71 for all targets
- **changed** — Updated cfg80211/mac80211 from kernel 6.18.7
- **changed** — Updated hostapd to master snapshot from August 2025
- **changed** — Updated dnsmasq to 2.91
- **changed** — Updated dropbear to 2025.89
- **changed** — Updated busybox to 1.37.0

Hi,

The OpenWrt community is proud to announce the first stable release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:
  * https://firmware-selector.openwrt.org?version=25.12.0

Download firmware images directly from our download servers:
  * https://downloads.openwrt.org/releases/25.12.0/targets/


Highlights in OpenWrt 25.12
===========================

OpenWrt 25.12.0 incorporates over 4700 commits since branching the previous OpenWrt 24.10 release and has been under development for over one year.

Only the main changes are listed below.  See [changelog-25.12.0](https://openwrt.org/releases/25.12/changelog-25.12.0) for the full changelog.

Honoring Dave Täht
==================

OpenWrt 25.12 is named Dave's Guitar to honor Dave Täht, who sadly passed away on April 1, 2025.

Dave played a key role in reducing bufferbloat and improving network latency in OpenWrt and across the wider internet. His work made networks faster, more responsive, and more reliable for millions of users.

This release is dedicated to his memory and lasting impact on the networking community.


General changes
===============

The hardware requirements did not change significantly. Most devices supported by OpenWrt 24.10 are also supported in OpenWrt 25.12.


Switch package manager from opkg to apk
=======================================

OpenWrt has transitioned from the traditional **opkg** package manager to **apk** (Alpine Package Keeper).

This change brings several advantages:
  * apk is still maintained; the OpenWrt opkg fork is no longer maintained.

apk supports most features of opkg. Only very few package names changed. The command line arguments of apk are different from the command line arguments of opkg.

For users migrating existing systems, an official [opkg to apk cheatsheet](https://openwrt.org/docs/guide-user/additional-software/opkg-to-apk-cheatsheet) is available to ease the transition and map common workflows.


Integration of attended sysupgrade
==================================

The [attended sysupgrade](https://openwrt.org/docs/guide-user/installation/attended.sysupgrade) LuCI application is now installed by default.
`owut` is included by default in images for devices with larger flash storage.

ASU allows devices to:
  * Upgrade to new OpenWrt firmware versions
  * Automatically rebuild firmware images with all currently installed packages
  * Preserve system configuration during upgrades
  * ASU allows integrating additional installed packages directly into the SquashFS filesystem, which stores packages more efficiently than the overlay filesystem.

This dramatically simplifies upgrades: with just a few clicks in LuCI and a short wait, a custom firmware image is built and installed without manual intervention.


Shell history is preserved
==========================

Shell command history is now preserved across sessions by storing it in a **RAM-backed filesystem**.

Benefits:
  * Command history is no longer lost between logins
  * No unnecessary writes to flash storage by default

For users who prefer persistent history storage, this behavior can be changed by editing: ''/etc/profile.d/busybox-history-file.sh''

⚠️ **Note:** Storing history on flash will increase write cycles and may impact [flash endurance](https://en.wikipedia.org/wiki/Flash_memory#Write_endurance) over time.


Integration of video feed
==========================

The [OpenWrt video feed](https://github.com/openwrt/video) with Qt5 and UI applications is integrated by default.


Wi-Fi scripts in ucode
======================


The Wi-Fi scripts were rewritten in ucode.
This is part of the rewrite of the management scripts from shell scripts to ucode.

uCode is used for system scripts because it is faster and safer than shell scripts, and integrates directly with ubus and UCI.

Wi-Fi and network management scripts re

_[Truncated at 4000 characters — full notes: https://github.com/openwrt/openwrt/releases/tag/v25.12.0]_