Debian ships a record-long list of Linux kernel fixes

The Debian project has issued security advisory DSA-6528-1 for the Linux kernel. Conventional in form, it stands out for sheer bulk: the list of fixed vulnerabilities scrolls on for screen after screen, running to many hundreds of CVE identifiers — from last year's numbers to the very latest.

The message, signed by Salvatore Bonaccorso and dated 29 September 2026, states the problem tersely. The flaws found in the kernel may lead to privilege escalation, denial of service or information leaks. There is no breakdown of the individual defects in the text itself — for a detailed account of each case the advisory points to the security tracker page for the linux package.

What is fixed

For the stable distribution — trixie — all the listed problems are resolved in kernel version 6.12.111-1. The maintainers recommend upgrading the linux packages without delay.

The size of the list reflects how kernel vulnerabilities are handled nowadays: ever since the Linux kernel community became its own CVE numbering authority, identifiers are assigned to nearly every security-relevant fix. As a result, even a routine cumulative update to the stable branch comes wrapped in an imposing wall of numbers. For an administrator the takeaway is unchanged: apply the update and reboot.

More technical detail is available in Debian's security tracker and in the descriptions of the individual CVEs.

Source: Hacker News