Skip to content

Release Notes

May 2026 (version 10.4)

Overview

The May 17th, 2026 release of DietPi v10.4 comes with fixes for CVE “Copy Fail” and CVE “Dirty Frag”, a new image for the Orange Pi 5B, simplified Linux packaging, and further enhancements and fixes.

The image is a Linux console screenshot showing how the "Copy Fail" Linux vulnerability is used to obtain root access, and add an SSH pubkey to the root account, as www-data user. And it shows that a DietPi update, which upgrades the kernel, fixes this vulnerability.

New images

  • Orange Pi 5B Dedicated images for the Orange Pi 5B are provided now. Previously, the Orange Pi 5 images could be used, but it was required to change the used device tree manually to enable board-specific features like WiFi.

Enhancements

  • Linux security The two recent major Linux vulnerabilities CVE-2026-31431 aka “Copy Fail”, CVE-2026-43284 and CVE-2026-43500 aka “Dirty Frag”, have been mitigated across all supported SBCs: Debian and Raspberry Pi Ltd pushed kernel updates containing the fix, and we did so for all kernel packages distributed with our APT repository. The DietPi update will upgrade kernel packages implicitly. Else please upgrade it yourself, or prevent the affected kernel modules from being loaded, as can be read here: MichaIng/DietPi#8122
  • General Persistent DietPi log files have been moved from /var/tmp/dietpi/logs to /var/lib/dietpi/logs. Since Debian Trixie, content of /var/tmp older than 30 days is cleared, which renders this directory inappropriate for any persistent files. And to be honest: It was never meant to be used the way we did it. The DietPi update will copy files over, but it cannot remove /var/tmp/dietpi, since the v10.3 updater itself is logging to it while it runs. On Debian Trixie, systemd-tmpfiles will remove it 30 days later. On Debian Bookworm, you may remove it manually, but the size is small.
  • NanoPi R76S The network interface names for the two Ethernet ports are now persistent on reboot. They previously could randomly swap on reboot. Many thanks to @oxoocoffee for reporting this: MichaIng/DietPi#7844
  • Allwinner/Amlogic/Rockchip SBCs We merged the linux-dtb-* package into the linux-image-* package. You might have recognized that an apt upgrade held back two packages, and an apt full-upgrade removed the linux-dtb-* package while upgrading linux-image-*, which is hence intended. Along with some other changes in our Armbian build system fork, this makes switching between kernel branches easier and more robust, and allows to keep multiple kernel branches installed concurrently safe. The DietPi update will imply the kernel upgrade, if not done yet, unless it was explicitly marked hold by the admin.
  • DietPi-Installer Cases of GRUB BIOS images with GPT partition table, but without dedicated BIOS boot partition, are now handled gracefully. GRUB throws warnings in those cases, and by default fails, as flashing the bootloader to the gap between GPT header and first partition is considered unreliable. But obviously, the image worked that way before, and Debian’s grub-pc package postinst script explicitly ignores the warnings, calling grub-install with the --force flag. The dietpi-installer will now do the same, if this exact case is detected: GPT partition table, no EFI partition => GRUB BIOS needed, but no BIOS boot partition either. Many thanks to @mews-se for reporting a related case of a VPS image: MichaIng/DietPi#8030
  • DietPi-Software | soju We migrated to the new official soju repository at Codeberg, after the its GitHub repository got archived. This implies some new releases, hence we recommend to update your soju instance with a dietpi-software reinstall 213.
  • DietPi-Software | Unbound We push our own up-to-date Unbound packages via our APT server now. This means, that also users who did not install Unbound via dietpi-software get our default config and reduced Debian-only content. Please let us know if you face any issues.
  • DietPi-Software | Java The version has been bumped to Java 26 for 64-bit systems. On ARMv7, Java 21 is the highest practically usable one: from Java 22 on, ARMv7 support for the HotSpot JVM is broken, hence the extremely slow Zero JVM is used. This causes e.g. Airsonic on the Odroid XU4 to require 1.5 hours to start. This limits the versions of some Java applications on ARMv7, like Minecraft to max v1.21.x. This bug is unlikely to be ever resolved, due to decreasing relevancy of 32-bit ARM architectures. The upstream bug is tracked here: https://bugs.openjdk.org/browse/JDK-8321125

Bug fixes

  • DietPi-Tools | DietPi-Drive_Manager Resolved a v10.3 regression where moving the rootfs on Raspberry Pi to a different drive caused an invalid /boot/firmware/cmdline.txt root entry, failing to boot. Many thanks to @TimH for reporting this issue: https://dietpi.com/forum/t/25154
  • DietPi-Software | Docker Resolved a v10.3 regression where a fresh Docker installation failed, since --no-reload was used when unmasking docker.service, which prevents docker.socket from starting up as well. Many thanks to @peracchi for reporting this issue: MichaIng/DietPi#8108
  • DietPi-Software | Home Assistant Resolved an issue where the installation might have failed, when starting it from within a desktop session. As we used runuser, environment variables were passed through to uv, notably XDG_DATA_HOME, which was then used as install directory for Python, instead of the intended service user’s home directory. All runuser calls have now been replaced by setpriv with the --reset-env flag, to guarantee a clean environment. Many thanks to @btuerk89 for reporting this issue: MichaIng/DietPi#8116
  • DietPi-Software | Synapse Resolved an issue where the installation might have failed, since dependencies were not installed as intended.
  • DietPi-Software | Immich/ownCloud Infinite Scale Resolved a v10.3 regression, where the service failed to start, as it does not have the permissions to “touch” its environment file, to trigger the systemd automount, if needed. Instead of “touch”, automounts for environment files are now triggered with test -e, which does not require write access.
  • DietPi-Software | Prometheus Node Exporter Resolved an issue on Raspberry Pi where the raspberrypi_exporter.service stored the CPU temperature in a wrong format, if a locale with comma (,) as decimal separator was selected on the host system. The service now enforces the C locale. The change is applied during the DietPi update as well. Many thanks to @Grip for reporting this issue: MichaIng/DietPi#8118

As always, many smaller code performance and stability improvements, visual and spelling fixes have been done, too much to list all of them here. Check out all code changes of this release on GitHub: MichaIng/DietPi!8139