CERT-FR Lists Debian LTS Kernel Flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CERT-FR advisory covers numerous Linux kernel vulnerabilities in Debian 12 LTS allowing privilege escalation, data exposure, or denial of service; patches available.
CERT-FR published an advisory consolidating multiple vulnerabilities discovered in the Linux kernel as shipped with Debian 12 (bookworm) LTS. The affected versions are those prior to 6.1.190-1 and 6.12.113-1~deb12u1. The vulnerabilities, drawn from upstream kernel fixes backported by the Debian LTS team, collectively enable privilege escalation, disclosure of sensitive data, and denial-of-service conditions across various kernel subsystems (networking, filesystems, drivers, memory management, etc., based on typical kernel CVE batches of this type).
No evidence of active exploitation is mentioned in the advisory; this is a routine Debian LTS security update bundling fixes accumulated from upstream kernel stable trees. The advisory references two Debian LTS security announcements (msg00035 and msg00044, October 2026) and enumerates an extremely large number of CVE identifiers — far exceeding typical kernel update batches — indicating a significant backlog of kernel fixes being applied in this cycle.
Defenders running Debian 12 bookworm with LTS support should prioritize updating to the fixed kernel versions referenced in the Debian LTS bulletins. Given the scale of the CVE list, organizations should treat this as a standard but important kernel patching cycle rather than an emergency, applying updates through normal maintenance windows unless specific CVEs in the list are independently confirmed as exploited.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1375
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,067 reports from 142 sources, 531 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs