CVE-2026-5172: buffer overflow in extract_addresses() on crafted resource records.
Linux kernel: CVE-2026-43284 ("Dirty Frag") — local privilege escalation via the IPsec ESP path. Only relevant on devices with kmod-ipsec / esp4/esp6 loaded. Fixed via the 6.12.87 kernel update.
ath79: Sitecom WLR-7100 (X7 AC1200): fix MAC address assignment, wire up 5 GHz WLAN LED, and move to the tiny target to free ~800 KiB of flash
ipq40xx: Pakedge WR-1: restore lost band label on the WLAN LEDs
mediatek: filogic: Cudy WR3000E/H/P/S v1 and WBR3000UAX v1 (ubootmod NAND builds): disable NMBM, which was mistakenly enabled and prevented the NAND from being used correctly
microchipsw: fix LAN8814 QSGMII soft reset
WiFi fixes and improvements
wifi-scripts: fix basic_rate mapping in the wpa_supplicant ucode generator
mac80211: update backports package to 6.18.26 (general stability improvements)
Core component updates
Linux kernel: update from 6.12.85 to 6.12.87
mac80211: update from 6.18.7 to 6.18.26
Upgrading to 25.12.4
Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.
For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.
Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.
TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).
Meraki MX60: Direct sysupgrade to 25.12.4 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.
Known issues
Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
Well, I could update one of my two Belkin RT3200s to 25.12.4 but now I get this message trying to update the second:
Build failed in 26s total = 0s in queue + 26s to build:
ASU server stderr =
Generate local signing keys...
WARNING: can't open config file: /builder/shared-workdir/build/staging_dir/host/etc/ssl/openssl.cnf
WARNING: can't open config file: /builder/shared-workdir/build/staging_dir/host/etc/ssl/openssl.cnf
read EC key
writing EC key
WARNING: opening /builder/packages/packages.adb: No such file or directory
Package list missing or not up-to-date, generating it.
Building package index...
ERROR: wget: exited with error 8
ERROR: openwrt-keyring-2025.12.10~f0670054-r1: unexpected end of file
ERROR: wget: exited with error 8
ERROR: libnetfilter-cthelper0-1.0.0-r2: unexpected end of file
make[2]: *** [Makefile:254: package_install] Error 2
make[1]: *** [Makefile:193: _call_manifest] Error 2
make: *** [Makefile:369: manifest] Error 2
Traceback (most recent call last):
File "/app/.venv/lib/python3.14/site-packages/rq/worker/base.py", line 1522, in perform_job
return_value = job.perform()
File "/app/.venv/lib/python3.14/site-packages/rq/job.py", line 1342, in perform
self._result = self._execute()
~~~~~~~~~~~~~^^
File "/app/.venv/lib/python3.14/site-packages/rq/job.py", line 1402, in _execute
result = self.func(*self.args, **self.kwargs)
File "/app/asu/build.py", line 494, in build
result = _build(build_request, job)
File "/app/asu/build.py", line 302, in _build
report_error(job, check_package_errors(job.meta["stderr"]))
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/app/asu/util.py", line 338, in report_error
raise RuntimeError(msg)
RuntimeError: Impossible package selection
ERROR: Build failed with status 500 (--version-to 25.12.4 --device mediatek/mt7622:linksys_e8450-ubi:squashfs)
The above errors are often due to the upgrade server lagging behind the
build server, first suggestion is to wait a while and try again.
Not the ASU server, I think it's the downloads server. That's a 404 (or maybe a 500) from when apk runs wget to get a package from the downloads server.
And I'll bet if you apk add htop, it will work fine, too. I have not experienced any of these wget 8 errors myself, only seen them reported by ASU users, across all of the clients. If you dig through all the ASU client support threads and various github repo's issues, you'll find like 50 of them by now...
Status: Error: Impossible package selection
Progress: 0s total = 0s in queue + 0s in build
Build failed in 0s total = 0s in queue + 0s to build:
ASU server stderr =
Generate local signing keys...
WARNING: can't open config file: /builder/shared-workdir/build/staging_dir/host/etc/ssl/openssl.cnf
WARNING: can't open config file: /builder/shared-workdir/build/staging_dir/host/etc/ssl/openssl.cnf
read EC key
writing EC key
WARNING: opening /builder/packages/packages.adb: No such file or directory
Package list missing or not up-to-date, generating it.
Building package index...
ERROR: wget: exited with error 8
ERROR: nftables-json-1.1.6-r1: unexpected end of file
make[2]: *** [Makefile:254: package_install] Error 1
make[1]: *** [Makefile:193: _call_manifest] Error 2
make: *** [Makefile:369: manifest] Error 2
Traceback (most recent call last):
File "/app/.venv/lib/python3.14/site-packages/rq/worker/base.py", line 1522, in perform_job
return_value = job.perform()
File "/app/.venv/lib/python3.14/site-packages/rq/job.py", line 1342, in perform
self._result = self._execute()
~~~~~~~~~~~~~^^
File "/app/.venv/lib/python3.14/site-packages/rq/job.py", line 1402, in _execute
result = self.func(*self.args, **self.kwargs)
File "/app/asu/build.py", line 494, in build
result = _build(build_request, job)
File "/app/asu/build.py", line 302, in _build
report_error(job, check_package_errors(job.meta["stderr"]))
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/app/asu/util.py", line 338, in report_error
raise RuntimeError(msg)
RuntimeError: Impossible package selection
ERROR: Build failed with status 500 (--version-to 25.12.4 --device mediatek/filogic:glinet_gl-mt6000:squashfs)
The above errors are often due to the upgrade server lagging behind the
build server, first suggestion is to wait a while and try again.
I also ran into the wget error 8 just now. As per the wget manual it indeed is a server error. Nothing to be done to that at client side.
However there's a bug report in ASU github, in which the reporter suggests not caching wget error 8 responses (unclear to me where it's actually cached) so that the client could try again right away.
@efahl@aparcar
seeing the wget error as well for the mediathek/filogic target only. firmware-selector.openwrt.org also reports the build error due to wget errors.
Version 25.12.4 r32933-4ccb782af7 (kernel 6.12.87)
Request hash:
9922abbb223c7faf1f1e348c7dd8a63d28a1dead1261ffcfd495c3be935cb354
--
Status: Error: Impossible package selection
Progress: 0s total = 0s in queue + 0s in build
Build failed in 0s total = 0s in queue + 0s to build:
ASU server stderr =
Generate local signing keys...
WARNING: can't open config file: /builder/shared-workdir/build/staging_dir/host/etc/ssl/openssl.cnf
WARNING: can't open config file: /builder/shared-workdir/build/staging_dir/host/etc/ssl/openssl.cnf
read EC key
writing EC key
WARNING: opening /builder/packages/packages.adb: No such file or directory
Package list missing or not up-to-date, generating it.
Building package index...
ERROR: wget: exited with error 8
ERROR: uhttpd-mod-ubus-2025.10.03~ebb92e6b-r1: unexpected end of file
ERROR: wget: exited with error 8
ERROR: tc-tiny-6.18.0-r2: unexpected end of file
make[2]: *** [Makefile:254: package_install] Error 2
make[1]: *** [Makefile:193: _call_manifest] Error 2
make: *** [Makefile:369: manifest] Error 2
Traceback (most recent call last):
File "/app/.venv/lib/python3.14/site-packages/rq/worker/base.py", line 1522, in perform_job
return_value = job.perform()
File "/app/.venv/lib/python3.14/site-packages/rq/job.py", line 1342, in perform
self._result = self._execute()
~~~~~~~~~~~~~^^
File "/app/.venv/lib/python3.14/site-packages/rq/job.py", line 1402, in _execute
result = self.func(*self.args, **self.kwargs)
File "/app/asu/build.py", line 494, in build
result = _build(build_request, job)
File "/app/asu/build.py", line 302, in _build
report_error(job, check_package_errors(job.meta["stderr"]))
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/app/asu/util.py", line 338, in report_error
raise RuntimeError(msg)
RuntimeError: Impossible package selection
ERROR: Build failed with status 500 (--version-to 25.12.4 --device ramips/mt7621:asus_rt-ax53u:squashfs)
The above errors are often due to the upgrade server lagging behind the
build server, first suggestion is to wait a while and try again. ```