# Multiple Linux kernel flaws affect Debian trixie

Published: 2026-08-28 · Severity: routine
Canonical: https://vorant.io/reports/8f42d19b-a896-5c49-8283-07d8ffcb70b5/multiple-linux-kernel-flaws-affect-debian-trixie

> Debian trixie before 6.12.105-1 contains multiple kernel vulnerabilities enabling privilege escalation, data breach, and denial of service.

CERT-FR advisory CERTFR-2026-AVI-1090 documents multiple vulnerabilities discovered in the Linux kernel shipped with Debian trixie. The advisory identifies at least 200 distinct CVEs affecting kernel versions prior to 6.12.105-1, with impacts spanning privilege escalation, confidentiality compromise, and denial of service. The affected systems are Debian trixie installations running vulnerable kernel versions. No specific details on exploitation in the wild or attack vector specifics are provided in the advisory; defenders should prioritize updating to kernel version 6.12.105-1 or later. The breadth of CVE coverage suggests this is a significant kernel patch release incorporating multiple security fixes across different subsystems.

## Mentioned in this report

- Vulnerabilities: CVE-2025-38525, CVE-2025-40054, CVE-2026-43197, CVE-2026-53092, CVE-2026-64017, CVE-2026-64586, CVE-2026-68082, CVE-2026-68118, CVE-2026-68132, CVE-2026-68138, CVE-2026-68159, CVE-2026-68166, CVE-2026-68169, CVE-2026-68198, CVE-2026-68253, CVE-2026-68254, CVE-2026-68264, CVE-2026-68266, CVE-2026-68267, CVE-2026-68273, CVE-2026-68276, CVE-2026-68322, CVE-2026-68367, CVE-2026-68431, CVE-2026-68451, CVE-2026-68452, CVE-2026-68480, CVE-2026-72111, CVE-2026-74440, CVE-2026-74441, CVE-2026-74442, CVE-2026-74443, CVE-2026-74444, CVE-2026-74445, CVE-2026-74446, CVE-2026-74447, CVE-2026-74448

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1090

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8f42d19b-a896-5c49-8283-07d8ffcb70b5/multiple-linux-kernel-flaws-affect-debian-trixie.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup