Yocto 6.0 Ships as a Four-Year LTS That Generates Its Own SBOM

Yocto Project 6.0, codenamed Wrynose, was released on 13 May 2026 as a long-term support version with maintenance committed until at least April 2030. It is built on the Linux 6.18 LTS kernel with a toolchain of GCC 15.2, glibc 2.43, LLVM 22.1, Go 1.26 and Rust 1.94, plus more than 300 recipe upgrades. Over 240 contributors submitted more than 4,000 commits to the core Yocto and OpenEmbedded repositories since the 5.3 release.

The security tooling is the part with consequences beyond the build system. The cve-check bbclass has been replaced by an integrated sbom-cve-check tool, SBOM output moves to SPDX 3.0 with concluded licences and initial package URL support, and TLS 1.0 and 1.1 are disabled by default in OpenSSL. Supported build hosts include Fedora 43, openSUSE Leap 16.0 and Ubuntu 26.04. Yocto 6.1 is scheduled for the fourth quarter of 2026 and the next LTS, 7.0, for 2028.

Anyone shipping a custom embedded Linux image is increasingly asked for two things at handover: a list of what is in the image, and a statement of which known vulnerabilities affect it. Producing those from a build system that already knows every component is the correct place to do it — a separate scanning pipeline that inspects the finished image has to infer what the build system knew for certain.

The four-year support window matters as much as the tooling. Industrial products routinely outlive their base distribution, and a device shipped in 2026 on a version maintained to 2030 has a defined position rather than an unspoken hope. It also sets a date on the calendar, which is more than most embedded projects start with.