Debian 13.7 "trixie" Released with 92 Security Fixes, Kernel Updates
Debian 13.7 "trixie" has been released, integrating fixes for 92 security advisories and updating 106 packages, including critical Linux kernel patches.
The Debian project has announced the release of Debian 13.7, codenamed "trixie." This point release consolidates 92 previously published security advisories and incorporates updates for 106 source packages. The release also includes an updated installer that reflects these security enhancements, ensuring that new installations are built upon a more secure foundation.
Six of the security advisories specifically address vulnerabilities within the Linux kernel, impacting both amd64 and arm64 architectures. These kernel fixes are crucial for system stability and security, addressing issues that could potentially lead to system compromise or denial of service. While existing systems configured to track security updates will have already received many of these patches, the point release ensures that new installations benefit from the latest security posture immediately.
A significant portion of the updates involve rebuilding packages against an updated glibc, the fundamental C library that most system programs rely on. This includes essential utilities like bash, busybox, docker.io, gnupg2, snapd, and zsh. The glibc updates themselves address critical issues such as a buffer overflow (CVE-2026-5928) and a buffer underflow (CVE-2026-5450), along with necessary compatibility changes for Linux 7.0 headers.
Several packages received a substantial number of fixes. QEMU, the machine emulator and virtualizer, accounts for 25 CVEs, while ImageMagick addresses 24 vulnerabilities. WolfSSL, a cryptographic library, has 15 fixes, and Perl includes 13 updates. Cyrus-imapd, a mail server, addresses nine CVEs, primarily related to insufficient access checks. Mbed TLS, another cryptographic library, has seven fixes, including issues related to client impersonation (CVE-2026-34873) and signature algorithm injection (CVE-2026-25834).
The boot chain also received attention, with U-boot, the bootloader common on embedded and ARM devices, receiving fixes for FIT image verification (CVE-2026-46728) and a BOOTP/DHCP buffer overread (CVE-2024-42040). QEMU's updates include a secure boot bypass (CVE-2026-16288) and a post_load check for its UEFI device (CVE-2026-61404), while sbsigntool has corrected its intermediate certificate verification for secure boot.
Perl and libhttp-tiny-perl address credential forwarding on redirects (CVE-2026-7017), a vulnerability where credentials could be inadvertently sent to a malicious destination during a redirect. Both packages also fix CRLF validation issues (CVE-2026-7010). Perl's updates also cover symlink and hardlink extraction flaws (CVE-2026-42496, CVE-2026-42497), which are relevant for archive handling.
Other notable fixes include Flask addressing a caching issue related to session access (CVE-2026-27205) by setting the "Vary: Cookie" header. Dhcpcd has corrected handling of IPv6 router advertisements (CVE-2026-14258), and Dnsmasq fixes buffer overflow and out-of-bounds read vulnerabilities (CVE-2026-12725, CVE-2026-12969).
Python3.13 includes a fix for a use-after-free regression in dict.clear() and addresses file overwrite issues (CVE-2026-11940) and incorrect handling of user/group IDs in tar files (CVE-2026-4360). Bettercap has improved its security by disabling its systemd service installation by default and fixing a remote denial-of-service vulnerability in its MySQL server module (CVE-2026-8276). OnionShare has also been updated to prevent writing files in Receive mode when uploads are disabled (CVE-2026-54707).
Existing Debian systems can receive these updates by pointing their package manager to a Debian mirror. The installer has been updated to incorporate these fixes, and the kernel ABI has been bumped to 6.12.107+deb13.