CERT-FR flags multiple Linux kernel vulnerabilities in Debian LTS 12 bookworm enabling privilege escalation, data disclosure and DoS
CERT-FR published an advisory (CERTFR-2026-AVI-1375, 23 October 2026) on multiple vulnerabilities in the Linux kernel packaged for Debian LTS 12 bookworm. According to the advisory, an attacker could exploit them to obtain privilege escalation, breach data confidentiality or cause a denial of service. The advisory lists more than 250 CVEs, from CVE-2023-52629 to CVE-2026-89616, and the published text is truncated at the end. It reports no active exploitation.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1375 covers more than 250 CVEs (CVE-2023-52629 through CVE-2026-89616) in the Linux kernel packaged for Debian LTS 12 bookworm. It says an attacker could obtain privilege escalation, breach data confidentiality or cause a denial of service. Affected are kernel packages earlier than 6.1.190-1 and earlier than 6.12.113-1~deb12u1. The advisory gives no per-CVE details, CVSS scores, attacker prerequisites or ranking by severity, and the published text is truncated.
Como funciona
The advisory does not describe how any of these flaws is triggered or at which step the kernel goes wrong. It only states the general impact classes: privilege escalation, loss of confidentiality and denial of service. A mechanism for individual CVEs would have to come from the Debian LTS bulletins or the CVE records, which the available text does not reproduce.
Por que é vulnerável
The articles do not state root causes for any of the CVEs, nor why they went unnoticed. The fix is delivered as updated Debian LTS kernel packages (6.1.190-1 and 6.12.113-1~deb12u1 are the versions the advisory uses as the affected threshold), but the advisory does not explain what the patches change.
Como foi descoberta
The articles do not say who found these flaws or how. CERT-FR published its advisory on 23 October 2026, pointing to Debian LTS security bulletins msg00035 (17 October 2026) and msg00044 (22 October 2026) for the fixes. The advisory reports no active exploitation.
Explicação gerada por IA a partir da matéria e dos artigos, em 26/10/2026 14:23.
Detalhes técnicos
- Affected: Debian LTS 12 bookworm kernel versions earlier than 6.1.190-1, and versions earlier than 6.12.113-1~deb12u1.
- Impact classes: privilege escalation, confidentiality loss, denial of service. The article gives no per-CVE details or CVSS scores.
- Vendor references: Debian LTS announcements msg00035 (17 October 2026) and msg00044 (22 October 2026).
Remediação
- Apply the fixed kernel packages described in the Debian LTS security bulletins, as CERT-FR directs.
- Reboot into the updated kernel after installation.
Linha do tempo
-
CERT-FR flags multiple Linux kernel vulnerabilities in Debian LTS 12 bookworm enabling privilege escalation, data disclosure and DoS
ler a análise desta fonte ocultar
CERT-FR published an advisory (CERTFR-2026-AVI-1375, 23 October 2026) on multiple vulnerabilities in the Linux kernel packaged for Debian LTS 12 bookworm. According to the advisory, an attacker could exploit them to obtain privilege escalation, breach data confidentiality or cause a denial of service. The advisory lists more than 250 CVEs, from CVE-2023-52629 to CVE-2026-89616, and the published text is truncated at the end. It reports no active exploitation.
Technical Details
- Affected: Debian LTS 12 bookworm kernel versions earlier than 6.1.190-1, and versions earlier than 6.12.113-1~deb12u1.
- Impact classes: privilege escalation, confidentiality loss, denial of service. The article gives no per-CVE details or CVSS scores.
- Vendor references: Debian LTS announcements msg00035 (17 October 2026) and msg00044 (22 October 2026).
Remediation
- Apply the fixed kernel packages described in the Debian LTS security bulletins, as CERT-FR directs.
- Reboot into the updated kernel after installation.