Debian Patches Dozens of Linux Kernel Flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CERT-FR advisory lists numerous Linux kernel vulnerabilities in Debian 13 (trixie) fixed in kernel version 6.12.113-1, enabling privilege escalation, DoS, or data exposure.
CERT-FR published an advisory (CERTFR-2026-AVI-1374) describing multiple vulnerabilities in the Linux kernel as shipped with Debian 13 (trixie) prior to version 6.12.113-1. The advisory references the Debian security announcement DSA msg00482 (16 October 2026) and enumerates over 200 CVE identifiers, most issued in 2026, affecting various kernel subsystems. No single root cause or exploit chain is described; each CVE represents a distinct kernel-level issue.
The cumulative risks identified by CERT-FR are privilege escalation, denial of service, and loss of data confidentiality. These are typical consequences of kernel memory-safety bugs (use-after-free, out-of-bounds read/write, race conditions) commonly fixed in large kernel security batches. The advisory does not indicate active exploitation in the wild; it is a routine vendor patch notification rather than a report of an ongoing campaign.
Defenders running Debian 13 should update affected systems to kernel package version 6.12.113-1 or later as soon as possible via standard Debian package management, referencing the official Debian Security Announce bulletin for patch details and the Debian security tracker for per-CVE technical specifics. Given the large number of CVEs and the presence of local privilege-escalation and DoS primitives, this should be treated as a priority patching cycle for all Debian-based Linux hosts, with particular attention to multi-tenant or shared systems where local privilege escalation is most impactful.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1374
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,237 reports from 143 sources, 591 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs