# Debian releases DSA-6141-1: a Linux kernel update fixing more than 40 vulnerabilities

- **Published on:** 2026-02-18
- **Category:** Security
- **Original page:** https://linuxgratis.com/en/articles/dsa-6141-kernel-42-vulnerabilities-debian

Debian patches dozens of Linux kernel vulnerabilities in trixie with version 6.12.73-1. Risks include privilege escalation, denial of service and information leaks.

---

On 18 February 2026 the Debian security team published advisory **DSA-6141-1**, a **Linux kernel** update that clears out a large batch of vulnerabilities. It ranks among the heaviest kernel advisories of the month, packing fixes for dozens of CVE identifiers from different kernel subsystems into a single release.

## What the advisory fixes

DSA-6141-1 gathers fixes for several vulnerabilities that had piled up in the kernel. The cited identifiers include **CVE-2025-40082** and **CVE-2025-68823**, plus broad ranges of 2025 CVEs (the CVE-2025-71203 through CVE-2025-71237 series) and 2026 CVEs (the CVE-2026-23111 through CVE-2026-23230 series). That last range covers, for example, *use-after-free* flaws in the networking and filesystem subsystems that had already been reported separately during the month.

Debian's own advisory says the issues could lead to three kinds of impact:

- **Privilege escalation**: a local user could gain permissions beyond what they are entitled to, in the worst case up to root privileges.
- **Denial of service (DoS)**: a deliberately triggered fault could hang the kernel or cause a *panic*, leaving the machine unusable.
- **Information leaks**: certain bugs let an attacker read memory regions they should never reach.

## Who is affected

The advisory applies to Debian's stable branch, codenamed **trixie**. Any system running the Debian-packaged Linux kernel on that branch —servers, desktops, virtual machines or containers that share the host kernel— is potentially exposed until the update lands.

As with most kernel flaws, many of these vulnerabilities need the attacker to already hold **local access** to the system or to be able to run unprivileged code. That does not make them harmless. In multi-user environments, on shared hosting, or after an initial compromise through another vector, a privilege-escalation flaw is exactly the piece that turns limited access into full control of the machine.

## Severity

Debian rates the set as **high** severity. None of the individual CVEs is described as remote, unauthenticated exploitation, but the mix of privilege escalation and possible kernel hangs is reason enough to apply the patch quickly, especially on systems exposed to untrusted users.

## Mitigation and patch

The fix is straightforward: **update the kernel package** to the corrected version. For the stable distribution (trixie), the issue is resolved in version **6.12.73-1**.

On a Debian system, run:

```bash
sudo apt update
sudo apt upgrade
```

After installing the new kernel you have to **reboot the machine** so the corrected kernel takes effect; kernel updates do nothing until the next boot. If you run a *live patching* solution, check that your provider covers these specific CVEs.

As a complementary best practice, keep the system's mandatory access control frameworks active, since they shrink the blast radius of an eventual compromise. To dig deeper, see our article on [SELinux and AppArmor](/en/articles/selinux-y-apparmor).

You can track the distribution's supported versions and support timeline on the [Debian](/en/debian) profile.

## Source

- Official advisory: [Debian Security Advisory DSA-6141-1 (linux)](https://lists.debian.org/debian-security-announce/2026/msg00050.html)
- Detail of one reference CVE: [CVE-2025-40082 on NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-40082)