1. Executive summary
CERT-FR published an advisory on 23 October 2026 covering multiple vulnerabilities in the Debian Linux kernel, affecting Debian 13 trixie at versions earlier than 6.12.113-1. The flaws allow privilege escalation, data confidentiality compromise and denial of service. Ten CVEs carry verified scores: two are CRITICAL at 9.8 (CVE-2026-72463 and CVE-2026-80980), the remainder HIGH between 7.1 and 8.8, with one (CVE-2026-80939) unscored. None of the ten is in CISA KEV and EPSS values are 0% or 1%, so there is no evidence of exploitation in the wild. The risk to EMEA financial services is concentrated in shared Linux estates: container hosts, hypervisors and appliance images built on Debian 13, where a local privilege escalation turns a low-privilege foothold into root.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28 | The fix is delivered as a Debian kernel package (6.12.113-1) that clients must pull from an upstream distribution, not from a vendor with a contractual patch SLA | Clients need to confirm that their ICT third-party inventory records Debian as a dependency and that the kernel update path is covered by an agreed maintenance arrangement |
| NIS2 Art. 21(2)(d) | Debian 13 is a supply chain component in container base images and appliance firmware, and the vulnerabilities sit in that component | Supply chain security measures should include tracking the kernel version in base images and rebuilding images once 6.12.113-1 is available |
3. Technical analysis & attack chain
This is a patch roundup. CERT-FR lists more than 200 CVE references against a single Debian kernel update, and the Debian security bulletin msg00482 of 16 October 2026 is the authoritative fix record. Verified scores exist for ten of them. The rest are referenced# Advisory AT-2026-10-23-1497: Debian Linux kernel flaws allow privilege escalation and DoS in 50+ CVEs
1. Executive summary
CERT-FR published an advisory on 23 October 2026 covering multiple vulnerabilities in the Debian Linux kernel, affecting Debian 13 trixie at versions earlier than 6.12.113-1. The flaws allow privilege escalation, data confidentiality compromise and denial of service. Ten CVEs carry verified scores: two are CRITICAL at 9.8 (CVE-2026-72463 and CVE-2026-80980), the remainder HIGH between 7.1 and 8.8, with one (CVE-2026-80939) unscored. None of the ten is in CISA KEV and EPSS values are 0% or 1%, so there is no evidence of exploitation in the wild. The risk to EMEA financial services is concentrated in shared Linux estates: container hosts, hypervisors and appliance images built on Debian 13, where a local privilege escalation turns a low-privilege foothold into root.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28 | The fix is delivered as a Debian kernel package (6.12.113-1) that clients must pull from an upstream distribution, not from a vendor with a contractual patch SLA | Clients need to confirm that their ICT third-party inventory records Debian as a dependency and that the kernel update path is covered by an agreed maintenance arrangement |
| NIS2 Art. 21(2)(d) | Debian 13 is a supply chain component in container base images and appliance firmware, and the vulnerabilities sit in that component | Supply chain security measures should include tracking the kernel version in base images and rebuilding images once 6.12.113-1 is available |
3. Technical analysis & attack chain
This is a patch roundup. CERT-FR lists more than 200 CVE references against a single Debian kernel update, and the Debian security bulletin msg00482 of 16 October 2026 is the authoritative fix record. Verified scores exist for ten of them. The rest are referenced by identifier only, with no severity, mechanism or component detail in the source. The advisory does not describe an observed attack, a threat actor, malware or exploitation in the wild. The attack chain below is the generic local-attacker path the flaw classes support, not a recorded intrusion.
Prioritised triage
Ordered by verified severity, then EPSS. No entry is in CISA KEV.
| CVE | Component | CVSS | KEV / EPSS | Why it matters |
|---|---|---|---|---|
| CVE-2026-72463 | Not stated in source | 9.8 CRITICAL | Not in KEV / 0% | Highest verified score in the set; treat as the lead item for patch scheduling |
| CVE-2026-80980 | Not stated in source | 9.8 CRITICAL | Not in KEV / 1% | Highest verified score, and the only entry with non-zero EPSS above 0% alongside CVE-2025-40158 |
| CVE-2026-80935 | Not stated in source | 8.8 HIGH | Not in KEV / 0% | High severity, no exploitation signal |
| CVE-2026-80937 | Not stated in source | 8.8 HIGH | Not in KEV / 0% | High severity, no exploitation signal |
| CVE-2025-40158 | Not stated in source | 8.1 HIGH | Not in KEV / 1% | Highest EPSS in the set at 1%; still no exploitation evidence |
| CVE-2025-38204 | Not stated in source | 7.8 HIGH | Not in KEV / 0% | CWE-125 out-of-bounds read; memory-safety class |
| CVE-2026-72315 | Not stated in source | 7.8 HIGH | Not in KEV / 0% | High severity, no exploitation signal |
| CVE-2026-74347 | Not stated in source | 7.8 HIGH | Not in KEV / 0% | High severity, no exploitation signal |
| CVE-2026-52988 | Not stated in source | 7.1 HIGH | Not in KEV / 0% | CWE-362 race condition; timing-dependent, harder to weaponise reliably |
| CVE-2026-80939 | Not stated in source | unknown | Not in KEV / 0% | No CVSS assigned; cannot be ranked on severity, schedule with the batch |
Attack chain (generic, not observed)
- An attacker obtains a low-privilege local account or code execution context on a Debian 13 host running a kernel earlier than 6.12.113-1. The source does not describe how that initial access is obtained; the kernel flaws are local privilege escalation and DoS primitives, not remote entry points.
- The attacker triggers one of the memory-safety flaws. CVE-2025-38204 is an out-of-bounds read (CWE-125), which leaks kernel memory contents and can expose pointers or sensitive data, supporting a confidentiality impact.
- CVE-2026-52988 is a race condition (CWE-362). Exploitation depends on winning a timing window, which makes reliable privilege escalation harder than a straight memory-corruption bug but does not remove the risk on multi-core hosts under load.
- Successful exploitation yields privilege escalation to root or a kernel-level denial of service that takes the host down. CERT-FR lists both outcomes, plus confidentiality compromise, as the risks across the set.
- No persistence, command-and-control, lateral movement or exfiltration detail is given in the source. The advisory stops at the vulnerability class.
The two CRITICAL entries (CVE-2026-72463, CVE-2026-80980) have no component, CWE or mechanism detail in the source. Their 9.8 scores come from NVD and should drive patch priority, but an analyst cannot build a targeted detection from them without the Debian bulletin or the CVE records.
4. Mitigation & containment
P1 within 24h
- Identify every Debian 13 trixie host, container base image and appliance running a kernel earlier than 6.12.113-1. Query with
uname -racross the estate and check image manifests for the kernel package version. - Patch to 6.12.113-1 per Debian security bulletin msg00482 (https://lists.debian.org/debian-security-announce/2026/msg00482.html). Reboot is required for a kernel update; schedule it rather than leaving the running kernel on the old version.
- For Debian LTS 12 bookworm estates, the parallel CERT-FR advisory CERTFR-2026-AVI-1375 gives fixed versions 6.1.190-1 and 6.12.113-1~deb12u1. Patch those to the matching version.
P2 within 72h
- Rebuild container base images on the patched kernel and redeploy. A patched host kernel does not fix an image that pins an old kernel for privileged or nested workloads.
- Restrict local shell access on internet-facing and multi-tenant hosts to named accounts. The flaws are local privilege escalation primitives; reducing who can run code locally reduces exposure while patching completes.
P3 within 7 days
- Add kernel version to the asset inventory feed so future Debian kernel advisories can be matched to hosts without a manual sweep.
- Review whether any Debian 13 appliance or virtualisation host sits outside the standard patch pipeline, since those are the systems most likely to stay on 6.12.x below 113-1.
5. Indicators of compromise
No indicators of compromise available in the source material. The CERT-FR advisory and the related Debian advisories describe vulnerability classes and fixed versions only; they contain no hashes, network indicators, file paths or behavioural telemetry.
6. Detection
Insufficient indicators to author detection rules. The sources give no distinctive strings, command-line flags, file names, registry keys or behavioural artefacts to build a YARA or Sigma rule from. The only actionable detection is a version check: flag any Debian 13 host reporting a kernel below 6.12.113-1, and any Debian 12 LTS host below 6.1.190-1 or 6.12.113-1~deb12u1.
CVE assessment
10 referenced CVEs — 2 critical (CVSS ≥ 9.0)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-72463 | 9.8 Critical | — | 0% | In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfr… |
| CVE-2026-80980 | 9.8 Critical | — | 1% | In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and out_of_sync sharing a byte… |
| CVE-2026-80935 | 8.8 High | — | 0% | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before… |
| CVE-2026-80937 | 8.8 High | — | 0% | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before… |
| CVE-2025-40158 | 8.1 High | — | 1% | In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_output() Use RCU in ip6_output() in… |
| CVE-2025-38204 | 7.8 High | — | 0% | In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds read in add_missing_ind… |
| CVE-2026-72315 | 7.8 High | — | 0% | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix busy dentry warning on unmount after DIO… |
| CVE-2026-74347 | 7.8 High | — | 0% | In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and… |
| CVE-2026-52988 | 7.1 High | — | 0% | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: join hook list via splice_list_rcu()… |
| CVE-2026-80939 | — | — | 0% | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: add .shutdown callback to stop rfkill po… |
7. Sources
- ANSSI France CERT-FR, "Multiples vulnérabilités dans le noyau Linux de Debian", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1374/, 2026-10-23.
- Debian Security Announce, msg00482, https://lists.debian.org/debian-security-announce/2026/msg00482.html, 2026-10-16.
- ANSSI France CERT-FR, "Multiples vulnérabilités dans le noyau Linux de Debian LTS", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1375/, 2026-10-23.
- Debian LTS Announce, msg00035, https://lists.debian.org/debian-lts-announce/2026/10/msg00035.html, 2026-10-17.
- Debian LTS Announce, msg00044, https://lists.debian.org/debian-lts-announce/2026/10/msg00044.html, 2026-10-22.
- NVD, EPSS and CISA KEV records for the ten scored CVEs, as supplied in the verified reference data.
8. Adverse Trace position
Adverse Trace assesses this as a high-volume kernel patch cycle with no exploitation in the wild: none of the ten scored CVEs is in CISA KEV, EPSS tops out at 1%, and the source records no actor, campaign or malware. The two 9.8 CRITICAL entries (CVE-2026-72463, CVE-2026-80980) justify priority patching, but the absence of component detail in the source means we cannot yet say which subsystem they touch or how reachable they are. Client impact is highest for firms running Debian 13 as a container host or virtualisation base, where a local privilege escalation has the most to gain. We will pull the Debian bulletin and the individual CVE records for the two CRITICAL entries to fill the component gap, and we will re-check KEV and EPSS status over the next 14 days. Clients should treat the version check in section 6 as the immediate action and report back any host that cannot reach 6.12.113-1.
Published via PulseTrace — Adverse Trace threat intelligence.