Blog
What a manufacturer with embedded Linux needs to know about the CRA, explained from an engineering point of view, with sources you can check.
Which CVEs really matter in your firmware (and which you can justify don't)
A scanner gives you hundreds of CVEs. The CRA asks for no known exploitable vulnerabilities. How to get from one list to the other: KEV, EPSS, severity and, above all, the context of your device.
How to get the SBOM of your Linux firmware: Yocto, Buildroot, or an image you didn't build
The CRA asks for a machine-readable inventory of components. How to produce it depending on how your firmware is built, what your build system already gives you, and why scanning the image is not enough.
What the CRA asks of your Linux firmware, and what you can check today
The Cyber Resilience Act requirements that affect an embedded Linux device, in engineer's terms, plus five checks you can run this afternoon on your own image.