# Debian LTS kernel multiple vulnerabilities privilege escalation

Published: 2026-09-25 · Severity: routine
Canonical: https://vorant.io/reports/4dd08aeb-1eb2-5379-aafd-4ba1f3a4613e/debian-lts-kernel-multiple-vulnerabilities-privilege-escalation

> Multiple Linux kernel flaws in Debian 12 allow privilege escalation, data disclosure, and denial of service; patch to 6.12.107-1~deb12u1.

CERT-FR has published a security advisory covering multiple vulnerabilities discovered in the Linux kernel shipped with Debian 12 (bookworm). The advisory identifies at least 40 distinct CVEs affecting kernel versions prior to 6.12.107-1~deb12u1. These flaws span multiple impact categories: privilege escalation, allowing local attackers to gain elevated access; confidentiality violations, exposing sensitive kernel data; and denial-of-service conditions. The vulnerabilities reside in core kernel subsystems and can be exploited by local threat actors or authenticated users. Debian LTS has issued patches bundled in the kernel security update. Administrators operating Debian 12 systems must apply the update immediately to mitigate these flaws.

## Mentioned in this report

- Vulnerabilities: CVE-2025-38525, CVE-2025-40054, CVE-2025-40074, CVE-2026-43197, CVE-2026-53092, CVE-2026-64017, CVE-2026-64216, CVE-2026-64581, CVE-2026-64586, CVE-2026-68082, CVE-2026-68118, CVE-2026-68132, CVE-2026-68138, CVE-2026-68159, CVE-2026-68166, CVE-2026-68169, CVE-2026-68198, CVE-2026-68253, CVE-2026-68254, CVE-2026-68264, CVE-2026-68266, CVE-2026-68267, CVE-2026-68273, CVE-2026-68276, CVE-2026-68322, CVE-2026-68367, CVE-2026-68431, CVE-2026-68451, CVE-2026-68452, CVE-2026-68480, CVE-2026-72111, CVE-2026-74440, CVE-2026-74441, CVE-2026-74442, CVE-2026-74443, CVE-2026-74444, CVE-2026-74445, CVE-2026-74446, CVE-2026-74447, CVE-2026-74448

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1232

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4dd08aeb-1eb2-5379-aafd-4ba1f3a4613e/debian-lts-kernel-multiple-vulnerabilities-privilege-escalation.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup