Readiness: LinuxCNC Machine Retrofit

Verdict: Ready with caveats · 2026-09-03 · est. parts cost $260–$460 (Raspberry Pi host plus one Mesa Ethernet card; the x86 desktop host path was not priced) Cybersecurity — software & network: Review before networking

This is the cold check for this lab — it establishes the baseline, so every line below carries its current price and availability for the next comparison. The lab is sourceable today: seven of its eight bill-of-materials lines are commodity computer hardware available cheaply from many sellers, and the Raspberry Pi 4 Model B carries a manufacturer commitment to stay in production until at least January 2034. The caveats are in the specialty item and in the paperwork. Mesa Electronics still sells Ethernet motion-control cards across the range the lab names, but the 7I92 / 7I92H / 7I92M the handout gives as an example now list at US$0.00 — no orderable price — with the 7I92T series at US$109.00 as the evident replacement, and Mesa publishes no stock figures at all, so lead time is unverified. Separately, the Raspberry Pi image checksum recorded in the lab materials no longer matches the checksum the project currently publishes, which will make a careful instructor think their download is corrupt.

Action required

Cybersecurity — software & network

Review before networking — A high-severity privilege-escalation flaw affects the exact LinuxCNC version the lab pins and a fixed release is already published, and two documented host operating systems plus the RTAI kernel line are past end of life.

What this means for your lab

The most concrete problem is on the controller itself rather than on the network: the LinuxCNC version this lab documents, 2.9.8, contains a flaw that lets anyone who can log in at that machine gain full administrator control of it. Updating to 2.9.10 fixes that, and it is a straightforward apt update. Beyond that, treat a retrofitted CNC controller as an appliance, not a classroom PC. Two of the operating systems the handout still lists as options, Debian 11 and Debian 10, no longer get security fixes, so build on Debian 13 instead. LinuxCNC can optionally publish live machine state to a message broker over the network, and nothing in the lab materials sets up a password or encryption for that, so anyone on the same network could read what the machine is doing if that feature is switched on — leave it off unless you need it. Nothing checked this run showed a remote login service, a web interface or a default password on the controller, and the documentation deliberately steers installers away from setting a root password. Put the controller and its Mesa card on their own isolated network segment, keep it off the campus network unless your IT group has agreed to it, and confirm the LinuxCNC version on each machine before students use it.

Not checked

• LinuxCNC 2.9.10 (confirmation that the fix is present): A lookup of 2.9.10 this run still matched the same advisory, because the Debian advisory's fixed version carries an epoch (1:2.9.4-2+deb13u1) that a bare upstream version string does not compare against cleanly. The advisory text itself states the flaw affects releases before 2.9.9, so 2.9.10 should carry the fix — but that was not independently confirmed this run.
• balenaEtcher, Rufus, Raspberry Pi Imager, Infra Recorder: no version is stated anywhere in the lab materials, so there is no exact version to check against an advisory database
• zsync: installed unpinned via apt; no exact version to check
• OpenGL 3.3 core profile, Mesa llvmpipe, libgpiod: system runtime libraries supplied by the host distribution and left unversioned in the documentation
• Raspberry Pi custom image builder (rpi-img-builder-lcnc): the repository is live but the images it builds are assembled at build time from whatever the chosen distribution serves; no manifest pins a version to check

Parts

Note on the Raspberry Pi: DigiKey stocks the board under packaging variants of the base part number SC0193 — SC0193(13) is described only as "RASPBERRY PI 4 DUAL RAM VARIANT" with no capacity stated, while SC0193(11) at the same $55.00 is described as the 2 GB board. PiShop's product page for the 4 GB board also cites SC0193 and specifies 4 GB LPDDR4-3200. The evidence therefore does not establish which orderable variant carries 4 GB — confirm "4GB" on the order line. The snapshot's floor is 512 MB with 4 GB recommended, so a 2 GB board would still run, just below the recommendation. Mesa cards are single-source and Mesa's storefront publishes no stock quantities on any page fetched for this report, so every Mesa row above is priced but not stock-verified.

Substitutes

Verify any substitute against its datasheet — and, for the Mesa cards, against your machine's existing I/O wiring — before ordering.

Other dependencies

• Live hybrid ISO linuxcnc_2.9.8-amd64.hybrid.iso — still published. The project's ISO directory lists it at 4.0G, dated 2026-01-04, so the URL in the handout still resolves.
• A newer release is out. The same index lists linuxcnc_2.9.10-amd64.hybrid.iso (3.9G, 2026-07-13), and the downloads page now leads with "LinuxCNC 2.9.10 Debian 13 Trixie PREEMPT-RT ISO (Download this then update to 2.9.10 with Synaptic or apt. 2.9.10 .iso image is WIP)". A pre-release linuxcnc_2.10.pre1-amd64.hybrid.iso (3.1G, 2026-01-11) is also on the server, matching the handout's note about a 2.10 upgrade path.
• Raspberry Pi image checksum no longer matches — fix the handout. The lab materials record the arm64 Pi image with MD5 4547e8a72433efb033f0a5cf166a5cd2. The downloads page currently publishes the Pi 4/5 SD card image with "MD5SUM 705b7f3c2f7b385f6cb094d05e01070e", the current file being image_2026-01-21-raspios-lcnc-2.9.8-trixie-arm64.zip (1.7G). An instructor who verifies the download against the recorded value will get a mismatch and may wrongly conclude the file is corrupt. The amd64 ISO's recorded MD5/SHA256 were not verified — that needs a 4 GB download and hash.
• Offline Debian packages — linuxcnc-uspace_2.9.8_amd64.deb (25M, 2026-03-27) is present in the ISO directory, alongside linuxcnc-uspace_2.9.8_amd64_probe2.deb. The linuxcnc-uspace_2.9.8_arm64.deb the handout names does not appear there; treat it as not located rather than gone — it may be served from the package repository instead.
• Package repository https://linuxcnc.org/dists/ — live, and every suite the handout's sources.list lines use is present and recently rebuilt: buster/ (2026-06-27), bullseye/ (2026-07-02), bookworm/ (2026-07-10), trixie/ (2026-07-11).
• Installer script https://www.linuxcnc.org/linuxcnc-install.sh — live, 2001 bytes.
• Raspberry Pi image builder https://github.com/rodw-au/rpi-img-builder-lcnc — live and maintained. Worth knowing before you try it: its README names the supported builder host systems as Debian Bookworm (testing), Ubuntu Jammy Jellyfish (recommended) and Ubuntu Noble Numbat (recommended) — so the machine you build the image on has its own requirements.
• Mesa Modbus driver documentation — live, but the driver is on a deprecation path. The page's own opening note reads: "The Mesa Modbus framework (modcompile and mesa_modbus) is superseded by the hm2_modbus driver and mesambccc-compiled MBCCB files. It remains available throughout the 2.9 series, but new configurations are encouraged to migrate." The lab names mesa_modbus as one of the HAL interfaces its card must use, so a configuration built on it today will need rework at 2.10.
• HAL GPIO driver documentation — live.
• Hardware Requirements wiki page — live, but obsolete by its own admission, and it fails over HTTPS. Its first line reads: "This information was current when LinuxCNC was called EMC2 and when Ubuntu 8.04 was new. ie some time around 2008. It should be viewed as currently unreliable". Its figures ("at least 256MB of RAM", "later Pentium II or III, 400MHz or higher", "Currently an x86 PC is required") contradict the lab's own current requirements. The HTTPS form of the URL presents a certificate that could not be validated, so it is reachable only over plain HTTP. Drop this link in favour of system-requirements.adoc.
• Windows zsync port https://www.assembla.com/spaces/zsync-windows/documents — effectively dead as a public download. The page returns only "Granting access, please wait..." — an access wall, not a document listing. Windows users following this link get nothing.
• balenaEtcher download page — live.
• Rufus https://rufus.ie/ — reachable, but the page is script-rendered and no readable text could be extracted, so its current download was not confirmed this run.
• Raspberry Pi Imager https://www.raspberrypi.com/software/ — not confirmed this run; the fetch was blocked, which for this domain most likely means bot protection rather than a dead link.
• Infra Recorder https://infrarecorder.org/ — not reachable this run, and the host was seen presenting a TLS certificate issued for a different domain, so an instructor clicking through may face a browser security warning ahead of a binary download. balenaEtcher and Rufus cover the same job.
• Fabrication — none. The lab package contains no PCB, CAD or custom fabrication files; the build is commercial off-the-shelf hardware wired to existing machine actuators.

Watch list

• Mesa 7I92 family — the plain 7I92/H/M already show no orderable price. Expect them to disappear from the store entirely; the handout's example part numbers should move to the 7I92T series or the 7I96S now.
• Mesa 7I96 — still priced at US$119.00 but reachable only through store search, not the Ethernet card category listing. That is the usual shape of a part being wound down in favour of the 7I96S; check it again next cycle.
• Mesa stock and lead time generally — a single-source vendor publishing no stock figures is the biggest sourcing unknown in this lab. Nothing in a catalog page tells you whether a card ships this week.
• The DVD-R install path — the ISO has grown release over release (2.9.1 3.4G → 2.9.4 3.5G → 2.9.8 4.0G) and a single-layer DVD-R holds about 4.38 GiB. The current images still fit, but not for many more releases — and neither a Raspberry Pi nor most current desktops have an optical drive at all. Plan on USB.
• Recorded checksums — they drifted once already. Any handout that pins an MD5 against a moving "latest image" link will drift again at the next image rebuild.
• The 4 GB Raspberry Pi variant — DigiKey's variant descriptions do not state capacity consistently. If the 2 GB and 4 GB boards keep sharing a base part number, ordering the wrong one stays easy.
• Debian 11 and 10 as documented targets — both are already past end of life and the LinuxCNC repository still serves suites for them, so the handout can still be followed onto an unsupported platform.