Open Source Summit + Embedded Linux Conference North America 2026

Due to increased interest in fine-grained analysis of kernel composition and security (due to the CRA and other recent cybersecurity legislation), there have been a number of recent projects to 1) generate SBOMS for the linux kernel, and 2) finish adding the remaining SPDX-License-Identifier lines to the kernel source tree. In this talk, Tim will describe the current status of both of these efforts. Good progress has been made to add missing SPDX id lines, but more work is needed to complete this project. Tim proposes a kselftest test to make sure there are no regressions in this area. The status of different kernel SBOM generation tools, and upstream status, will be described.

This work should be of interest to companies interested in complying with cybersecurity requirements, as well as those involved with license compliance efforts.