CERT-FR: multiple Linux kernel vulnerabilities in Debian 13 trixie allow privilege escalation, data disclosure and DoS
CERT-FR published advisory CERTFR-2026-AVI-1374 on multiple vulnerabilities in the Linux kernel shipped with Debian 13 trixie, affecting versions prior to 6.12.113-1. According to the advisory, an attacker could exploit them to achieve privilege escalation, breach data confidentiality or cause a denial of service. The advisory is based on Debian security bulletin msg00482 of 16 October 2026 and references a very large number of CVEs (hundreds, with the published list truncated). It does not report active exploitation and gives no CVSS scores or per-CVE technical detail.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1374 covers a very large batch of Linux kernel vulnerabilities (CVE-2025-38204, CVE-2025-40158 and many CVE-2026-xxxxx identifiers) in Debian 13 trixie. Versions prior to 6.12.113-1 are affected and the fix is 6.12.113-1 or later. The advisory says an attacker could get privilege escalation, a breach of data confidentiality or a denial of service. It gives no CVSS scores, no per-CVE detail and no prerequisites such as local access, so severity cannot be ranked per CVE. The CVE list in the source is truncated.
Como funciona
The advisory does not describe how any of these flaws work. It only lists the impact classes (privilege escalation, data disclosure, denial of service) and does not say which kernel component, input or event is involved in each CVE. A step-by-step mechanism cannot be given from the available material.
Por que é vulnerável
The articles give no root cause for any of the CVEs. The advisory only says the issues are fixed in the Debian kernel package 6.12.113-1, without saying what the fixes change or why the flaws went unnoticed.
Onde está
No file, function or commit is named. The fixes are referenced through Debian security bulletin msg00482 of 16 October 2026 (kernel package 6.12.113-1).
Como foi descoberta
The articles do not say who found the flaws or how. CERT-FR published its advisory on 23 October 2026, based on Debian security bulletin msg00482 of 16 October 2026. The advisory does not report active exploitation.
Explicação gerada por IA a partir da matéria e dos artigos, em 27/10/2026 13:18.
Detalhes técnicos
- Affected: Debian 13 trixie, Linux kernel versions prior to 6.12.113-1.
- Impact classes: local privilege escalation, confidentiality breach, denial of service.
- CVEs referenced include CVE-2025-38204, CVE-2025-40158 and a long series of CVE-2026-xxxxx identifiers; the list in the source is truncated, so only the complete entries are recorded here.
- No IOCs, threat actors or exploitation details are provided.
Remediação
- Update the Debian kernel to version 6.12.113-1 or later, following Debian security bulletin msg00482 (https://lists.debian.org/debian-security-announce/2026/msg00482.html), as CERT-FR directs.
Linha do tempo
-
CERT-FR: multiple Linux kernel vulnerabilities in Debian 13 trixie allow privilege escalation, data disclosure and DoS
ler a análise desta fonte ocultar
CERT-FR published advisory CERTFR-2026-AVI-1374 on multiple vulnerabilities in the Linux kernel shipped with Debian 13 trixie, affecting versions prior to 6.12.113-1. According to the advisory, an attacker could exploit them to achieve privilege escalation, breach data confidentiality or cause a denial of service. The advisory is based on Debian security bulletin msg00482 of 16 October 2026 and references a very large number of CVEs (hundreds, with the published list truncated). It does not report active exploitation and gives no CVSS scores or per-CVE technical detail.
Technical Details
- Affected: Debian 13 trixie, Linux kernel versions prior to 6.12.113-1.
- Impact classes: local privilege escalation, confidentiality breach, denial of service.
- CVEs referenced include CVE-2025-38204, CVE-2025-40158 and a long series of CVE-2026-xxxxx identifiers; the list in the source is truncated, so only the complete entries are recorded here.
- No IOCs, threat actors or exploitation details are provided.
Remediation
- Update the Debian kernel to version 6.12.113-1 or later, following Debian security bulletin msg00482 (https://lists.debian.org/debian-security-announce/2026/msg00482.html), as CERT-FR directs.