coreboot 26.09 Adds Framework Laptop 12 and Advances AMD Turin Support

The coreboot project released coreboot 26.09 on October 1 after merging 1,324 commits from 120 authors during the cycle. The release adds support for a range of systems, including the Framework Laptop 12 with 13th Gen Intel Core processors, several older desktop boards, Intel NUC hardware and GIGABYTE's MZ33-AR1 EPYC server motherboard.

For PC users, the Framework Laptop 12 addition is the most recognizable new client platform. It means the board now exists in upstream coreboot's supported mainboard tree; it does not by itself mean every retail Framework Laptop 12 installation automatically switches to coreboot or that replacing factory firmware is risk-free.

The AMD Turin proof-of-concept work progressed beyond early scaffolding in this release. coreboot added CPPC support, interrupt-routing hooks, firmware-table configuration and ACPI descriptions for CXL and MPDMA devices, alongside SEV NVRAM integration work.

GIGABYTE's MZ33-AR1 is the first motherboard added on this Turin path. Its upstream port includes PCIe slot and MCIO topology, onboard-device configuration and BMC BIOS-update packaging. This is meaningful progress for open firmware on current server hardware, but the release notes describe the Turin work as an evolving proof of concept rather than a blanket statement that all EPYC 9005 systems are production-ready with coreboot.

coreboot's firmware build now uses the GNU C23 language standard. Mainboard code was updated to use the C23 static_assert keyword, while a temporary attempt to move host tooling to the same baseline was reverted because it broke builds on older Linux distributions. Host tools therefore retain their existing C11 baseline.

The release also puts substantial emphasis on defensive parsing. Changes add stricter checks around EDID buffers and extension blocks, FDT headers, BMP dimensions and offsets, CBFS headers, FMAP regions and TPM2 response sizes. These are hardening changes rather than evidence that a specific exploitable vulnerability affected every coreboot system.

coreboot also formalized rules for AI-assisted code review. AI-generated Gerrit comments must be marked as such and manually reviewed before posting; automated AI output may not set Code-Review +2 or trigger submission. The policy also prohibits using AI-generated comments to reply to human review comments.

That policy is separate from the firmware features, but it is notable operationally: coreboot is permitting AI assistance while keeping review authority and responsibility with human contributors.