New Update Debian 13.6 Released With Security Updates for Linux, Apache, Curl, QEMU, and More

[Brownie2019]

The Debian Project has released Debian 13.6, the sixth point update for its stable Debian 13 “trixie” distribution. This update, released on July 11, 2026, includes a collection of security fixes, critical bug corrections, and updated installation images.

It does not introduce a new version of Debian; existing systems can be upgraded to the latest revision via standard APT updates from an updated Debian mirror.

Debian 13.6 Released
Debian 13.6 consolidates packages previously issued through Debian Security Advisories (DSAs), so systems that regularly install updates from the trixie-security repository will have fewer packages to download.

The updated installer includes the fixes from this stable point release and features a Linux kernel ABI bump to version 6.12.94+deb13. Administrators can update their systems by running `apt update && apt upgrade`. At the same time, new deployments can use the updated Debian 13.6 installation media.

A significant change in this release concerns UEFI Secure Boot.

Full Story;

Debian 13.6 Released With Security Updates for Linux, Apache, Curl, QEMU, and More

The Debian Project has released Debian 13.6, the sixth point update for its stable Debian 13 “trixie” distribution.

gbhackers.com

 

[Bot]

Full Story;

Debian 13.6 Released With Security Updates for Linux, Apache, Curl, QEMU, and More

The Debian Project has released Debian 13.6, the sixth point update for its stable Debian 13 “trixie” distribution.

gbhackers.com

Verification needed

The quoted announcement cannot be confirmed from the information provided. In particular, Debian 13 “trixie” was released in 2025, while the stated Debian 13.6 release date of July 11, 2026 is in the future relative to the current date. This may indicate a future-dated, inaccurate, or altered article.

The GBHackers article should not be treated as the authoritative source for the release status or the Secure Boot changes. Verify the claim through Debian’s official channels:

• Debian news announcements
• Official Debian 13 release information
• Debian package tracker

For an existing Debian 13 installation, ordinary updates should normally be obtained from the configured official Debian repositories. Before applying them, review the repository configuration and package changes; do not add third-party repositories merely to obtain a point-release update.

The quoted `apt update && apt upgrade` command is standard, but it does not by itself verify that the claimed point release exists or explain any Secure Boot requirements. Until an official Debian announcement is available, the Debian 13.6 and kernel `6.12.94+deb13` claims should be regarded as unverified.

 

[lokamoka820]

New Debian 13 Kernel Security Update Fixes “Zapscape” and “SCTPhantom”

The Debian Project released a new kernel security update for Debian 13 “Trixie” users on August 6th, 2026, just a week after the previous kernel update, addressing new flaws in the Linux 6.12 LTS kernel.

The new Debian 13 “Trixie” kernel update addresses a total of 28 flaws, a smaller number compared to the 68 vulnerabilities patched in last week’s kernel security update. These new Linux kernel vulnerabilities may lead to privilege escalation, denial of service, or information leaks.

The most important one in this update is CVE-2026-64564, a.k.a. “SCTPhantom,” an 18-year-old use-after-free in the kernel’s SCTP ASCONF handling that lets a local unprivileged user get root and escape containers.

There’s also CVE-2026-64561, a.k.a. “Zapscape,” a use-after-free in KVM’s MMU code that could either allow a VM guest’s root user to escalate to root on the host or allow an attacker or compromised website to spin up a throwaway guest and attack the host kernel from inside it on a host running no VMs at all. This requires nested virtualization enabled and works only on AMD or Intel Ice-Lake-SP+ CPUs.

Some other interesting flaws patched in this update are CVE-2025-40098, a NULL pointer dereference in the ALSA cs35l41 audio codec driver leading to a system crash, and CVE-2026-64562, a use-after-free in KVM’s nested-VMX (nVMX) code leading to a host kernel crash or denial of service.

The rest of the security vulnerabilities patched in this new kernel security update are lower-profile kernel-subsystem fixes. They fix issues in the Bluetooth QCA driver, mac80211 Wi-Fi driver, netfilter nf_tables subsystem, the Intel i801 SMBus driver, or SCTP’s ASCONF/dynamic-address-reconfiguration code.

The full list of CVEs fixed in this update are CVE-2025-40098, CVE-2026-45897, CVE-2026-45901, CVE-2026-53078, CVE-2026-53090, CVE-2026-64205, CVE-2026-64280, CVE-2026-64290, CVE-2026-64561, CVE-2026-64562, CVE-2026-64563, CVE-2026-64564, CVE-2026-64565, CVE-2026-64567, CVE-2026-64568, CVE-2026-64569, CVE-2026-64570, CVE-2026-64571, CVE-2026-64572, CVE-2026-64573, CVE-2026-64574, CVE-2026-64576, CVE-2026-64577, CVE-2026-64578, CVE-2026-64579, CVE-2026-64580, CVE-2026-64583, and CVE-2026-64584.

All Debian 13 “Trixie” users are urged to update their installations to Linux kernel 6.12.101-1 as soon as possible. To update your installation, use a terminal emulator and run the sudo apt update && sudo apt full-upgrade commands. Don’t forget to reboot your computer after installing the new kernel version.

https://9to5linux.com/new-debian-13-kernel-security-update-fixes-zapscape-and-sctphantom