• Debian packages:
  • apt:
    • Bugs:
      • replied to #1078608: apt update silently leaves old index data
  • firmware-nonfree:
    • Merge requests:
      • opened and merged !151: Update to 20260622
    • Uploads:
      • uploaded version 20260622-1 to unstable
      • uploaded version 20260622-1~bpo13+1 to trixie-backports
  • hexagon-dsp-binaries:
    • Bugs:
      • opened #1141904: Missing new DSP binaries for shikra
  • initramfs-tools:
    • Bugs:
      • replied to #1142780: initramfs-tools: ip=dhcp lease is not renewed while initramfs remains active
  • kernel-handbook:
    • Merge requests:
      • opened and merged !15: Update “Building a development version of the Debian kernel package”
  • linux:
    • Bugs:
      • closed #851695: replacing base package with -unsigned removes module files
      • replied to #1126671: linux-image-6.17.13+deb13-amd64: Disconnect root (path=/) during heavy load on NvME, partial corruption on NTFS.crash soon but not yet
      • closed #1130365: linux-image-6.18.15+deb14-amd64: kernel panic during startup
      • closed #1140892: thunderbolt: Intel Goshen Ridge CL state regression breaks dock tunneling since 6.12.94
      • closed #1141185: linux-image-6.12.94+deb13-amd64: Occasional read problems in RAID/LVM/ext4 stack when under stress.
      • replied to #1141355: linux-image-6.1.0-49-amd64: procfs deadlock triggered by drop_caches on 6.1.0-49-amd64 (regression from 6.1.0-37) (LTS)
      • replied to #1141448: MT7921 intermittently disappears after reboot on ASUS TUF Gaming F17 FX706HF
      • replied to #1141541: linux: i915 kernel BUG in i915_drm_client_remove_object from Xorg causing hard lock on 6.12.94+deb13-amd64
      • replied to #1141866: linux-image-7.1.3+deb14-amd64: no display on AMD Kaveri/CIK APU VGA output (amdgpu DC regression)
    • Merge requests:
      • closed !1936: [sparc64] Add nvme module to scsi-modules udeb
      • reviewed and merged !1968: [bookworm] net: mana: refresh driver from 6.12.94 (LTS)
      • merged !1984: udeb: Ensure that aead and macsec modules are in the right packages
      • reviewed and closed !2003: 6.1 backport: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242) (LTS)
      • merged !2004: [sparc64] udeb: scsi-modules: Use the default module list
      • opened !2010: [x86] Backport security fixes for KVM (LTS)
      • merged !2012: Update to 6.1.177 (LTS)
      • merged !2017: Enable NTFS_FS (and replace NTFS3_FS)
      • opened and closed !2019: Fix rtmutex security issues (LTS)
      • opened !2027: Include rsync in Build-Depends-Arch for any build including tools
      • merged !2038: [loong64] drivers/mmc/host: Enable MMC_LOONGSON2 as module
      • reviewed !2041: Update to 5.10.262 (LTS)
    • Uploads:
      • uploaded version 5.10.259-1 to bullseye-security (LTS)
      • uploaded version 6.1.176-1 to bookworm-security (LTS)
      • uploaded version 6.1.177-1 to bookworm-security (LTS)
      • uploaded version 6.12.95-1~bpo12+1 to bookworm-backports (LTS)
      • uploaded version 7.0.13-1~bpo13+1 to trixie-backports
      • uploaded version 7.1.3-1~bpo13+1 to trixie-backports
  • linux-6.1 (LTS):
    • Uploads:
      • uploaded version 6.1.176-1~deb11u1 to bullseye-security
      • uploaded version 6.1.177-1~deb11u1 to bullseye-security
  • linux-6.12 (LTS):
    • Uploads:
      • uploaded version 6.12.96-1~deb12u1 to bookworm-security (not yet accepted)
  • linux-base:
    • Merge requests:
      • reviewed !21: Draft: Add hooks to copy vmlinuz file to /boot
  • localechooser:
    • Bugs:
      • replied to #1141886: localechooser: Turkey is inconsistently classified under Asia in regionmap
  • wireless-regdb:
    • Uploads:
      • uploaded version 2026.05.30-1~deb11u1 to bullseye-security (LTS)
• Mailing lists:
  • debian-kernel:
    • posted Agenda items for kernel-team meeting on 2026-07-01
    • posted Agenda items for kernel-team meeting on 2026-07-22
  • debian-lts-announce:
    • posted [SECURITY] [DLA 4664-1] linux security update
    • posted [SECURITY] [DLA 4665-1] linux security update
    • posted [SECURITY] [DLA 4671-1] linux-6.1 security update
    • posted [SECURITY] [DLA 4676-1] wireless-regdb new upstream version
    • posted [SECURITY] [DLA 4688-1] linux security update
    • posted [SECURITY] [DLA 4700-1] linux-6.1 security update
  • linux-kernel:
    • posted [PATCH] irqchip/irq-imgpdc: Remove unused driver
  • stable (mostly LTS):
    • posted [7.1] drm/amd/display: Add dp_skip_rbr flag for NUTMEG
    • replied to [PATCH 5.10 01/96] net/sched: act_pedit: use NLA_POLICY for parsing ex keys
    • replied to [PATCH 5.10 11/96] slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
    • replied to [PATCH 5.10 81/96] nfsd: check get_user() return when reading princhashlen
    • replied to [PATCH 5.10 89/96] misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
    • replied to [PATCH 5.10 94/96] mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC

There’s yet another Linux kernel exploit based on container functions, here’s the result when run as user_t on a SE Linux system:

$ ./packet_edit_meme 
[*] target /bin/su as uid 1000; entry at file offset 0x4340; shellcode 48 bytes
unshare: Permission denied
[-] page-cache corruption failed

Here is the audit log entry for this failure:

type=AVC msg=audit(1785640621.498:1843): avc:  denied  { create } for  pid=1770 comm="packet_edit_mem" scontext=user_u:user_r:user_t:s0 tcontext=user_u:user_r:user_t:s0 tclass=user_namespace permissive=0

Here’s the result of running it from the unconfined_t domain:

$ ./packet_edit_meme 
[*] target /bin/su as uid 1001; entry at file offset 0x4340; shellcode 48 bytes
[+] su entry overwritten; exec'ing su -> interactive root shell
# id
uid=0(root) gid=0(root) groups=0(root),1001(test2) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
# 

Daniel Baumann wrote a blog post describing how this is fixed for Debian systems without SE Linux.