Between 8 September and 22 October 2026 Debian published seven Linux kernel security updates: two DSAs for Debian 13 (trixie) and five LTS advisories (DLAs) for Debian 12 (bookworm), which now receives security fixes from the LTS team. Each one lists hundreds of CVEs, and Debian summarises the impact the same way every time: the flaws "may lead to a privilege escalation, denial of service or information leaks". The fix only takes effect after a reboot into the new kernel.
At a glance
| Release | Source package | Advisory | Date | Fixed version | CVEs |
|---|---|---|---|---|---|
| Debian 13 (trixie) | linux | DSA-6528-1 | 29 Sep 2026 | 6.12.111-1 | 1,311 |
| Debian 13 (trixie) | linux | DSA-6568-1 | 16 Oct 2026 | 6.12.113-1 | 273 |
| Debian 12 (bookworm) | linux (6.1) | DLA-4777-1 | 8 Sep 2026 | 6.1.187-1 | 600 |
| Debian 12 (bookworm) | linux (6.1) | DLA-4841-1 | 17 Oct 2026 | 6.1.190-1 | 924 |
| Debian 12 (bookworm) | linux-6.12 | DLA-4788-1, DLA-4817-1, DLA-4850-1 | 19 Sep, 4 Oct, 22 Oct 2026 | 6.12.113-1~deb12u1 (latest) | 412, 1,312, 575 |
Severity: the highest-scored CVE among the ones we looked up is CVE-2026-72463, a use-after-free in the kernel's xfrm (IPsec) receive path with a CNA score of 9.8 (Critical). The kernel CNA's own scenario describes it as reachable by remote IPsec traffic on VPN gateways that use VTI or xfrm interfaces. It is fixed in DSA-6568-1 and DLA-4850-1. None of the CVEs in these seven advisories is in the CISA Known Exploited Vulnerabilities catalog as of 30 October 2026.
What the vulnerabilities are
The lists cover the whole kernel: networking (netfilter, IPv6, IPsec), file systems (JFS, SMB client), drivers and more. A few examples from DSA-6568-1: CVE-2025-40158 (IPv6 output path, CNA 8.1), CVE-2026-52988 (nf_tables, CNA 7.1, also fixed for bookworm in DLA-4841-1) and CVE-2026-74347 (netfilter conntrack timeouts, CNA 7.8). Of the six CVEs we looked up, four are scored as local (the attacker needs an account or code running on the machine) and two as reachable over the network.
During the same weeks CISA added four older kernel CVEs to its KEV catalog: CVE-2025-39682, CVE-2025-39964 and CVE-2026-53266 on 18 September, and CVE-2026-46300 on 28 October. Debian's security tracker shows all four fixed for trixie and for the bookworm 6.1 kernel in earlier updates, so those kernels at the versions above already include them.
Are you affected?
Every Debian 12 or 13 machine running a kernel older than the fixed version is affected. Check the running kernel and the installed kernel packages:
uname -r
dpkg -l 'linux-image-*' | grep '^ii'
apt policy linux-image-amd64Debian kernel package names carry an ABI name that changes with every update. After these updates you should see linux-image-6.12.113+deb13-amd64 on trixie and linux-image-6.1.0-54-amd64 on bookworm (the 6.1 series), pulled in by the linux-image-amd64 metapackage. If you installed the 6.12 series on bookworm, its metapackage is linux-image-6.12-amd64. Cloud images may use the -cloud-amd64 flavour instead; uname -r tells you which one you run.
How to update
sudo apt update
sudo apt upgrade
dpkg -l 'linux-image-*' | grep '^ii'Use apt upgrade or apt full-upgrade. Because each update brings a new package name, the metapackage needs to install a new package; according to the manual pages, apt upgrade installs new packages when dependencies require it, while apt-get upgrade never installs packages that are not already installed, so with apt-get the kernel can stay held back.
Restart or reboot?
A reboot is required. Until then the old kernel keeps running. After the reboot, confirm:
uname -r
sudo needrestart -kuname -r should show the new ABI name, and needrestart -k (from the needrestart package) checks only for an obsolete running kernel. On a virtual server, the kernel inside your server is yours to update and reboot; updates to the provider's host do not replace it.
Sources
- security-tracker.debian.org/tracker/DSA-6568-1
- lists.debian.org/debian-security-announce/2026/msg00482.html
- debian.org/security/2026/dsa-6568
- security-tracker.debian.org/tracker/DSA-6528-1
- lists.debian.org/debian-security-announce/2026/msg00441.html
- debian.org/security/2026/dsa-6528
- security-tracker.debian.org/tracker/DLA-4841-1
- lists.debian.org/debian-lts-announce/2026/10/msg00035.html
- security-tracker.debian.org/tracker/DLA-4777-1
- lists.debian.org/debian-lts-announce/2026/09/msg00012.html
- security-tracker.debian.org/tracker/DLA-4850-1
- security-tracker.debian.org/tracker/DLA-4817-1
- security-tracker.debian.org/tracker/DLA-4788-1
- cve.org/CVERecord?id=CVE-2026-72463
- cve.org/CVERecord?id=CVE-2025-40158
- cve.org/CVERecord?id=CVE-2026-52988
- cve.org/CVERecord?id=CVE-2026-74347
- security-tracker.debian.org/tracker/CVE-2025-39964
- security-tracker.debian.org/tracker/CVE-2026-53266
- cisa.gov/known-exploited-vulnerabilities-catalog
- deb.debian.org/debian-security/dists/trixie-security/main/binary-amd64/Packages.xz
- deb.debian.org/debian-security/dists/bookworm-security/main/binary-amd64/Packages.xz
- kernel-team.pages.debian.net/kernel-handbook/ch-versions.html
- manpages.debian.org/trixie/apt/apt.8.en.html
- manpages.debian.org/trixie/apt/apt-get.8.en.html
- manpages.debian.org/trixie/needrestart/needrestart.1.en.html
Comments
0 total · 0 threads