Zephyr RTOS Powers Space, Satellites, and Smart Devices at Scale | Kate Stewart, Linux Foundation

Embedded systems teams are shipping products into safety-critical environments with no clear path to regulatory compliance, and supply chain disruptions are forcing hardware redesigns that erase years of firmware investment. The pressure to meet new requirements like the EU Cyber Resilience Act (CRA) while maintaining lean, long-lived devices has never been higher. In this exclusive interview with Swapnil Bhartiya, Kate Stewart, Vice President of Dependable Embedded Systems at the Linux Foundation, marks ten years of Zephyr RTOS by breaking down how the project achieved CVE authority status, automatic SBOM generation, and concept approval for functional safety certification, and where the project is headed next. Key Topics Covered: How Zephyr achieved CVE Numbering Authority status in 2017 and what that means for vulnerability management in embedded systems Automatic SBOM generation via command-line options and Zephyr's CRA readiness posture IEC 61508 safety certification progress and the requirements traceability model being built upstream Zephyr's role in mixed-criticality architectures, pairing with Linux and FPGAs for edge AI trigger-and-compute patterns How AI agents are being evaluated as maintainer tools for code review, refactoring, and requirements traceability #ZephyrRTOS #EmbeddedSystems #RTOS #LinuxFoundation #EdgeAI #OpenSourceSecurity #SBOM #FunctionalSafety #CyberResilienceAct #IoT #EmbeddedLinux #SPDX #CVE #RISCV #OpenSource