← Watch feed

Low 43 Bitcoin Committed Dec 1, 2025 · 16:50 UTC

docs(core): changelog for 2.9.5

Trezor/Trezor firmware

eacc9e51 View source ↗

Public commit record

What the developer wrote

Authored by Roman Zeyde

72/100 · Adequate

docs(core): changelog for 2.9.5

[no changelog]

(cherry picked from commit 666497180be4e02f2e9b61767f616eefaef4ab6b)

✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body

The short version

What changed, and why it matters

This commit is just a documentation update: it adds a changelog note saying that firmware version 2.9.5 fixes a bug where the device's tamper-detection red screen of death (RSOD) was not appearing. The actual code fix is not shown in this commit, so we can only judge the issue from the one-line changelog entry. If the RSOD really failed to display when a tamper event happened, a local attacker who opened or probed the device might not trigger the expected warning, potentially hiding physical tampering. However, this commit itself changes no code, so its direct security risk is low and the severity depends entirely on the unseen fix.

Recommended action

Treat this commit as a release-note marker, not a patch. Review the actual code change in pull request #6165 to determine whether the tamper RSOD failure was accompanied by any bypass of tamper detection, secure-element lockdown, or seed-destruction behavior. If only the warning screen was missing while other protections remained active, the issue is a reliability/UX bug rather than a critical security vulnerability. Update the classification after inspecting the linked PR.

Security signals we found

Changelog entry describes a tamper-mitigation UI failure

Fix is labeled as affecting tamper RSOD (red screen of death)

No source code or binary changes in this commit

Cross-model impact implied by updates to all core device changelogs

No CVE, advisory, or researcher attribution present in the commit

Technical analysis

Evidence from the diff

The commit updates six changelog files and removes a fragment file to record that pull request #6165 fixed ‘tamper RSOD not showing.’ RSOD (red screen of death) is Trezor’s tamper-response UI. A failure to show it implies the tamper-mitigation path’s display/notification branch was broken, even if the underlying tamper detection and secure-wipe logic may still have worked. Because the diff contains only changelog text, there is no source-level evidence of the bug’s root cause, affected models, or whether other tamper responses were impaired. The entry applies to all current core models (T2B1, T2T1, T3B1, T3T1, T3W1).

Changed components

Trezor Core firmware changelog documentationTamper-detection UI/RSOD subsystem (referenced, not modified here)Trezor Model T and T3 device families (T2B1, T2T1, T3B1, T3T1, T3W1)

Inspect captured patch +36 / −1

diff --git a/core/.changelog.d/6165.fixed b/core/.changelog.d/6165.fixed
deleted file mode 100644
index 0fffc2372..000000000
--- a/core/.changelog.d/6165.fixed
+++ /dev/null
@@ -1 +0,0 @@
-Fixed tamper RSOD not showing.
diff --git a/core/CHANGELOG.T2B1.md b/core/CHANGELOG.T2B1.md
index 6831663a7..0c9222a67 100644
--- a/core/CHANGELOG.T2B1.md
+++ b/core/CHANGELOG.T2B1.md
@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [2.9.5] (internal release)
+
+### Fixed
+- Fixed tamper RSOD not showing.  [#6165]
+
 ## [2.9.4] (19th November 2025)
 
 ### Added
@@ -1219,3 +1224,4 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 [#6076]: https://github.com/trezor/trezor-firmware/pull/6076
 [#6096]: https://github.com/trezor/trezor-firmware/pull/6096
 [#6100]: https://github.com/trezor/trezor-firmware/pull/6100
+[#6165]: https://github.com/trezor/trezor-firmware/pull/6165
diff --git a/core/CHANGELOG.T2T1.md b/core/CHANGELOG.T2T1.md
index f88f5f596..d0fc43be2 100644
--- a/core/CHANGELOG.T2T1.md
+++ b/core/CHANGELOG.T2T1.md
@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [2.9.5] (internal release)
+
+### Fixed
+- Fixed tamper RSOD not showing.  [#6165]
+
 ## [2.9.4] (19th November 2025)
 
 ### Added
@@ -1216,3 +1221,4 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 [#6076]: https://github.com/trezor/trezor-firmware/pull/6076
 [#6096]: https://github.com/trezor/trezor-firmware/pull/6096
 [#6100]: https://github.com/trezor/trezor-firmware/pull/6100
+[#6165]: https://github.com/trezor/trezor-firmware/pull/6165
diff --git a/core/CHANGELOG.T3B1.md b/core/CHANGELOG.T3B1.md
index 48dcc2d44..685fa757c 100644
--- a/core/CHANGELOG.T3B1.md
+++ b/core/CHANGELOG.T3B1.md
@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [2.9.5] (internal release)
+
+### Fixed
+- Fixed tamper RSOD not showing.  [#6165]
+
 ## [2.9.4] (19th November 2025)
 
 ### Added
@@ -1212,3 +1217,4 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 [#6076]: https://github.com/trezor/trezor-firmware/pull/6076
 [#6096]: https://github.com/trezor/trezor-firmware/pull/6096
 [#6100]: https://github.com/trezor/trezor-firmware/pull/6100
+[#6165]: https://github.com/trezor/trezor-firmware/pull/6165
diff --git a/core/CHANGELOG.T3T1.md b/core/CHANGELOG.T3T1.md
index 8a39120b4..0c5cb27c4 100644
--- a/core/CHANGELOG.T3T1.md
+++ b/core/CHANGELOG.T3T1.md
@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [2.9.5] (internal release)
+
+### Fixed
+- Fixed tamper RSOD not showing.  [#6165]
+
 ## [2.9.4] (19th November 2025)
 
 ### Added
@@ -1260,3 +1265,4 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 [#6076]: https://github.com/trezor/trezor-firmware/pull/6076
 [#6096]: https://github.com/trezor/trezor-firmware/pull/6096
 [#6100]: https://github.com/trezor/trezor-firmware/pull/6100
+[#6165]: https://github.com/trezor/trezor-firmware/pull/6165
diff --git a/core/CHANGELOG.T3W1.md b/core/CHANGELOG.T3W1.md
index 4bdaea33f..e3808d1e1 100644
--- a/core/CHANGELOG.T3W1.md
+++ b/core/CHANGELOG.T3W1.md
@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [2.9.5] (internal release)
+
+### Fixed
+- Fixed tamper RSOD not showing.  [#6165]
+
 ## [2.9.4] (19th November 2025)
 
 ### Added
@@ -70,3 +75,4 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 [#6076]: https://github.com/trezor/trezor-firmware/pull/6076
 [#6096]: https://github.com/trezor/trezor-firmware/pull/6096
 [#6100]: https://github.com/trezor/trezor-firmware/pull/6100
+[#6165]: https://github.com/trezor/trezor-firmware/pull/6165
diff --git a/core/CHANGELOG.md b/core/CHANGELOG.md
index 475f17f2e..1b291fbd3 100644
--- a/core/CHANGELOG.md
+++ b/core/CHANGELOG.md
@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [2.9.5] (internal release)
+
+### Fixed
+- Fixed tamper RSOD not showing.  [#6165]
+
 ## [2.9.4] (19th November 2025)
 
 ### Added
@@ -1319,3 +1324,4 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 [#6076]: https://github.com/trezor/trezor-firmware/pull/6076
 [#6096]: https://github.com/trezor/trezor-firmware/pull/6096
 [#6100]: https://github.com/trezor/trezor-firmware/pull/6100
+[#6165]: https://github.com/trezor/trezor-firmware/pull/6165

Risk score

Why this scored 43/100

Our methodology →

Potential impact 12/30

Exploitability 8/25

Stealth signal 7/15

Affected reach 10/15

Confidence 4/10

Evidence quality 2/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 43/100

Community notes

Related watches

refactor(core): digest EIP-1559/EIP-7702 magic without RLP encoding

test(core): test RLP self-encoding bytestrings

chore(core): remove sha1 from regular FW