# Multiple kernel vulnerabilities in Debian LTS 11 and 12

Published: 2026-08-14 · Severity: routine
Canonical: https://vorant.io/reports/a55d32c1-b531-5df1-94e3-ae7a17d4c409/multiple-kernel-vulnerabilities-in-debian-lts-11-and-12

> Debian LTS published fixes for multiple Linux kernel vulnerabilities affecting bullseye and bookworm, enabling privilege escalation, data disclosure, and denial of service.

Debian LTS released security updates addressing multiple vulnerabilities in the Linux kernel shipped with Debian 11 (bullseye) and Debian 12 (bookworm) distributions. The vulnerabilities span a range of kernel subsystems and can result in privilege escalation, confidentiality breaches, and denial of service conditions. Affected versions include Debian LTS 11 before kernel 6.1.180-1~deb11u1 and Debian LTS 12 before kernel 6.12.100-1~deb12u1. Organizations running these LTS releases must apply the published kernel updates to mitigate the identified issues. The advisory references over 200 individual CVEs, indicating a significant cumulative patch set covering multiple kernel components.

## Mentioned in this report

- Vulnerabilities: CVE-2024-36013, CVE-2025-21807, CVE-2025-40196, CVE-2026-31610, CVE-2026-43216, CVE-2026-45944, CVE-2026-46093, CVE-2026-46135, CVE-2026-53005, CVE-2026-53027, CVE-2026-53226, CVE-2026-53260, CVE-2026-53332, CVE-2026-53365, CVE-2026-53392, CVE-2026-53393, CVE-2026-53399, CVE-2026-53400, CVE-2026-53402, CVE-2026-63797, CVE-2026-63806, CVE-2026-63810, CVE-2026-63815, CVE-2026-63816, CVE-2026-63818, CVE-2026-63829, CVE-2026-63970, CVE-2026-64187, CVE-2026-64189, CVE-2026-64192, CVE-2026-64206, CVE-2026-64227, CVE-2026-64241, CVE-2026-64248, CVE-2026-64250, CVE-2026-64256, CVE-2026-64265, CVE-2026-64266, CVE-2026-64268, CVE-2026-64269

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1031

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a55d32c1-b531-5df1-94e3-ae7a17d4c409/multiple-kernel-vulnerabilities-in-debian-lts-11-and-12.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup