There are 155 open security issues in trixie.
There are 22 open security issues in sid.
There are 23 open security issues in forky.
There are 1342 open security issues in bullseye.
There are 612 open security issues in bookworm.
You can find information about how to handle these issues in the security team's documentation.
There are 636 open security issues in buster.
commit 5d8903c07f2356b224ac16626107ef16ed222cfc
Merge: 8e29fdb38 8b9db1192
Author: Bastian Blank <waldi@debian.org>
Date: Mon Oct 13 17:46:40 2025 +0000
Merge branch 'enable-damon-stat' into 'debian/latest'
debian/config: Enable DAMON_STAT for memory access statistics collection
See merge request kernel-team/linux!1616
commit 8b9db11923170dd20543096a5e550749c0758fd4
Author: Yunseong Kim <ysk@kzalloc.com>
Date: Tue Aug 19 23:03:24 2025 +0000
debian/config: Enable DAMON_STAT for memory access statistics collection
The current Debian kernel already enables the DAMON framework and key
features like DAMON_RECLAIM and DAMON_LRU_SORT. However, utilizing the raw
monitoring data provided by DAMON for system-wide analysis can require
complex setup and interpretation of the results.
CONFIG_DAMON_STAT provides DAMON_STAT, an in-kernel solution that
automates this process. This module automatically runs DAMON for the entire
physical memory of the system and summarizes the results into
easy-to-understand statistical metrics. This specifically includes
estimated memory bandwidth (hotness) and memory idle time percentiles
(coldness).
This feature is designed to be always-on in production environments. It
balances accuracy and performance by auto-tuning monitoring intervals.
According to real-world tests cited in the upstream documentation[1], it
typically consumes less than 1% of a single CPU's time
("0.x % single CPU time").
Enabling this option greatly helps system administrators and developers to
more easily understand memory behavior, identify bottlenecks, and find
opportunities for memory management optimization, especially on
large-scale systems.
Even when built into the kernel by setting CONFIG_DAMON_STAT=y, its
operation can be controlled at runtime or boot time via the
'damon_stat.enabled' module parameter.
[1] https://docs.kernel.org/next/admin-guide/mm/damon/stat.html
Signed-off-by: Yunseong Kim <ysk@kzalloc.com>
commit 8e29fdb38c192aed7d2cb00223c3f3dab6808818
Merge: f178285d5 c33ddd3d6
Author: Bastian Blank <waldi@debian.org>
Date: Mon Oct 13 17:03:03 2025 +0000
Merge branch 'install-cpupower-service' into 'debian/latest'
linux-cpupower: Install files for cpupower.service systemd service
See merge request kernel-team/linux!1674
commit f178285d5c86ff2f1637268d17dac710fc285fc1
Merge: dd9d1318f 555f4a043
Author: Bastian Blank <waldi@debian.org>
Date: Mon Oct 13 16:49:43 2025 +0000
Merge branch 'salsa-ci-source-suffix' into 'debian/latest'
d/salsa-ci.yml: Adjust filenames to allow source package name suffix
See merge request kernel-team/linux!1663
commit 555f4a04359e482902bc338e8500572c17849b99
Author: Ben Hutchings <benh@debian.org>
Date: Mon Sep 29 13:55:15 2025 +0200
d/salsa-ci.yml: Adjust filenames to allow source package name suffix
Currently salsa-ci.yml assumes the source package name is "linux", but
in LTS there is always a backported kernel package with a suffix to
its name.
Update the literal filenames for packed source packages, and some of
the filename patterns, to allow for this.
commit dd9d1318f073152c4ef791f2d428060f9c31933c
Merge: 2446d6a65 c22662ca6
Author: Bastian Blank <waldi@debian.org>
Date: Mon Oct 13 16:34:43 2025 +0000
Merge branch 'drop-sb-compat' into 'debian/latest'
Drop some Secure Boot backward compatibility
See merge request kernel-team/linux!1667
commit c22662ca6621f00342ffa1f49c6a1c9f5bab0b00
Author: Bastian Blank <waldi@debian.org>
Date: Sun Oct 5 12:06:50 2025 +0200
Don't longer use UEFI DBX for module denylisting
Debian does not sign modules with the secure boot key anymore. We can
instead denylist the complete kernel version.
commit bc3d403028bf603a1637c0dc45d49de4ccb2e0be
Author: Bastian Blank <waldi@debian.org>
Date: Sun Oct 5 12:05:51 2025 +0200
Only trust Machine Owner Key (MOK) if enabled
commit 2446d6a65075d60d3c100ef6ec18939902460466
Merge: 03f310f4a 942933e58
Author: Bastian Blank <waldi@debian.org>
Date: Mon Oct 13 15:54:57 2025 +0000
Merge branch 'rv64-6.17' into 'debian/latest'
riscv64 config update for linux 6.17
See merge request kernel-team/linux!1665
commit c33ddd3d6ab39ddd814b2e63d2f23e40e6fb187b
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Mon Oct 13 13:35:55 2025 +0200
linux-cpupower: Install files for cpupower.service systemd service
Install required files for the cpupower.service systemd service without
enabling it. This provides /etc/cpupower-service.conf configuration
file, the required systemd service unit and the required libexec
cpupower script.
Provide a linux-cpupower.README.Debian with instructions to enable the
systemd service.
Closes: #894906
commit 03f310f4ac95d2b5c1b6fd537bebc8c2d3606096
Merge: 4bd9b275f e4df22c07
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Sun Oct 12 19:24:03 2025 +0200
Merge branch '6.17-stable-updates' into 'debian/latest'
Update to 6.17.2
See merge request kernel-team/linux!1672
commit e4df22c07cf78de53c81ae304e5dc45c59b22b5d
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Sun Oct 12 15:09:59 2025 +0200
Update to 6.17.2
commit 4bd9b275f4cee190949b4a3d831cdf605eb3497e
Merge: b19e18ab8 101ef5d58
Author: Bastian Blank <waldi@debian.org>
Date: Sat Oct 11 16:40:10 2025 +0000
Merge branch 'cleanup-orig' into 'debian/latest'
Cleanup orig target
See merge request kernel-team/linux!1671
commit 101ef5d58b71c8c542054e3053a9a0cba1831b4a
Author: Bastian Blank <waldi@debian.org>
Date: Sat Oct 11 15:23:07 2025 +0200
Run gencontrol from orig target
commit 7d99be1996edcec3a0a5b8a847d53563679ab9f2
Author: Bastian Blank <waldi@debian.org>
Date: Sat Oct 11 15:21:51 2025 +0200
Accept non-xz compression for orig tar
commit 1bfe65e2b8a0c919c34b435e97098bb1bf005648
Author: Bastian Blank <waldi@debian.org>
Date: Sat Oct 11 15:21:40 2025 +0200
Use automatic variables if possible
commit e89014f0dd3c76749aa7c61c1abc7466cd9e84d4
Author: Bastian Blank <waldi@debian.org>
Date: Sat Oct 11 15:20:55 2025 +0200
Make sure orig tar is not extracted every time
commit b19e18ab846f75e024307930d7dd70adfd93e8ff
Merge: e0ec05630 c5a9d93f5
Author: Bastian Blank <waldi@debian.org>
Date: Sat Oct 11 12:45:33 2025 +0000
Merge branch 'cleanup-install' into 'debian/latest'
Use more debhelper files
See merge request kernel-team/linux!1664
commit e0ec056304b12b95064382e7a17ebedfef46a985
Merge: e36ea1e78 57cf2acec
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Thu Oct 9 21:30:54 2025 +0200
Merge branch '6.17-stable-updates' into 'debian/latest'
Update to 6.17.1
See merge request kernel-team/linux!1668
commit c5a9d93f5f5d36404b610945be39e3acfabeb1b2
Author: Bastian Blank <waldi@debian.org>
Date: Wed Oct 1 19:52:56 2025 +0200
Replace manual cp calls with debhelper
commit 0d1e1f28df543336b30196479214380bb0145cb3
Author: Bastian Blank <waldi@debian.org>
Date: Sun Sep 28 12:50:55 2025 +0200
Replace manual dh_install calls with debhelper
commit e36ea1e78bf1b32f9610b51a8f51ab7d25671821
Merge: 048dab3fb b5c87c999
Author: Bastian Blank <waldi@debian.org>
Date: Wed Oct 8 19:58:23 2025 +0000
Merge branch 'disable-bcachefs' into 'debian/latest'
Disable bcachefs filesystem support
See merge request kernel-team/linux!1634
commit 5bd0225126f308167ea8d04d00937c1968ea9f37
Author: Bastian Blank <waldi@debian.org>
Date: Sun Sep 28 11:38:49 2025 +0200
Replace manual symlinks with debhelper
commit 37c58bfe450296b6f5f20e2ef1e8e07bf658a288
Author: Bastian Blank <waldi@debian.org>
Date: Tue Oct 7 16:21:48 2025 +0200
Suppress generation of wrong build-id symlinks
commit 57cf2acec33316d28dacb0baaacb740195ac9158
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Mon Oct 6 14:35:14 2025 +0200
Update to 6.17.1
commit b5c87c999dee6c5d393c456851edd4df72d44c3d
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Tue Sep 9 20:43:03 2025 +0200
linux-image: Add NEWS entry documenting disabled bcachefs support
commit 4162d4fcfba625237a7e456b7118c1590e00d9b9
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Sat Sep 6 11:14:12 2025 +0200
Disable bcachefs filesystem support
Revert "Enable bcachefs filesystem support"
This reverts commit 46d2e0c5d5a1bcfb363a10bdb04a8ffd23d2f54a.
Effectively bcachefs filesystem since upstream commit ebf2bfec412a
("MAINTAINERS: mark bcachefs externally maintained") in v6.17-rc4 is
only externally maintained.
Closes: #1112681
commit 942933e5837f13e06baea876268488b28572bbcc
Author: Aurelien Jarno <aurelien@aurel32.net>
Date: Tue Sep 30 22:05:38 2025 +0200
[riscv64] Enable PCIE_SOPHGO_DW, enable RTC_DRV_CV1800 and SOPHGO_CV1800B_DMAMUX as modules
commit cb79774d97d74f5d3962212863186374c9d47ce3
Author: Aurelien Jarno <aurelien@aurel32.net>
Date: Tue Sep 30 21:51:35 2025 +0200
[riscv64] Enable ARCH_ANDES
commit 9272b4d70069189b031381f1d2054ac3ef5352ed
Author: Aurelien Jarno <aurelien@aurel32.net>
Date: Tue Sep 30 21:40:21 2025 +0200
[riscv64] Enable ACLINT_SSWI
Renamed from THEAD_C900_ACLINT_SSWI (see upstream commit df0f030ee7e444c55341f4210124115878284125)
commit 048dab3fb1ae10fe971046f709072eafb23ba698
Merge: 6279b9760 1c0e8d36d
Author: Bastian Blank <waldi@debian.org>
Date: Tue Sep 30 10:45:24 2025 +0000
Merge branch 'linux-6.17' into 'debian/latest'
Update to 6.17
See merge request kernel-team/linux!1630
commit 1c0e8d36d03aa7fa38dfc2520e0044dda77871db
Author: Bastian Blank <waldi@debian.org>
Date: Sun Aug 31 20:19:33 2025 +0200
Update to 6.17
commit 6279b97607e4b181e6e98173628022a16fbf807a
Merge: f8ac83649 fdba03744
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Fri Sep 19 06:14:46 2025 +0200
Merge branch 'gcc-15' into 'debian/latest'
Compile with gcc-15 on all architectures
See merge request kernel-team/linux!1632
commit fdba0374430064d3fd64363877ab9f97da549b6e
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Thu Sep 4 22:10:39 2025 +0200
Compile with gcc-15 on all architectures
commit f8ac836495c4de327bf02cba15ac7faa289cc09d
Merge: e1e7a8ec8 113fc9a29
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Thu Sep 18 20:28:02 2025 +0200
Merge branch 'salsa-ci/early-cache-orig' into 'debian/latest'
d/salsa-ci.yml: Early move orig tarballs back where they can be cached
See merge request kernel-team/linux!1645
commit e1e7a8ec8080a8d933123f3f1ec3e2965b96bcdd
Merge: 167b300f2 f287a9302
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Wed Sep 17 18:12:16 2025 +0200
Merge branch 'bug-1114898-nfsv42-getxattr-regression' into 'debian/latest'
Fix regression: NFS 4.2 reports "Operation Not Supported" on getxattr calls
See merge request kernel-team/linux!1646
commit 113fc9a29d6cc8b49a6b27bbc9914c36b3490070
Author: Santiago Ruano Rincón <santiagorr@riseup.net>
Date: Tue Sep 16 14:37:24 2025 -0300
d/salsa-ci.yml: Early move orig tarballs back where they can be cached
This change is more consistent with the behaviour previous to the move
to the sbuild-based build (25142ca41756b6fd4b40e6440c720b201d13b79f). In
case of failure or timeouts during the build script, the orig tarballs
can still be cached.
commit f287a9302e4c1cc9017effe75612857ac3260461
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Tue Sep 16 22:05:27 2025 +0200
NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server
commit 6b4497355dca1c9773f213e115d6c9ed9099f11c
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Tue Sep 16 22:04:20 2025 +0200
NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported
commit 974f229ab3520570900ca7881aa7e737a4a088cb
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Tue Sep 16 22:03:08 2025 +0200
NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set
commit 062c7dcccc718c0f7228c0191e5ee495a0e916e8
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Tue Sep 16 22:00:25 2025 +0200
NFSv4: Don't clear capabilities that won't be reset
Closes: #1114898
commit 167b300f2f9f95426b0d86670ceec15ce84405a6
Merge: 42f02e1af 25142ca41
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Mon Sep 15 04:17:31 2025 +0200
Merge branch 'salsa-ci/sbuild+unshare' into 'debian/latest'
Merge the extract-source job into the build's job script
See merge request kernel-team/linux!1548
commit 25142ca41756b6fd4b40e6440c720b201d13b79f
Author: Santiago Ruano Rincón <santiagorr@riseup.net>
Date: Sun Sep 14 12:38:29 2025 -0300
d/salsa-ci.yml: Suppress unreleased changes and mismatching distribution lintian tags
This follows c705dcbe9e8c098c5b84536b92151246f6ddf659 commit from the
salsa CI team's pipeline.
The UNRELEASED target distribution is common while preparing an update,
so it should not be triggered by the pipeline. Also, when the target
release is UNRELEASED, the pipeline builds the package for unstable, and
the values between d/changelog and the Distribution: in .changes
mismatch.
commit 5f3f69a579d61d4c4f1eadc4419c88babfc3c859
Author: Santiago Ruano Rincón <santiagorr@riseup.net>
Date: Mon May 26 23:35:12 2025 -0300
d/salsa-ci.yml: Merge the extract-source job into the build's job script
To follow salsa-ci-team!569, that switches the pipeline to use sbuild
and the unshare backend.
This completely removes the provisioning stage. The customization made
in the extract-source job is now adapted and handled directly in the
build job. After creating the source package with dpkg-buildpackage,
sbuild is told to build the binary packages using the .dsc (via
BUILD_COMMAND).
commit 42f02e1af163944e4661224037c6146a4994ba38
Merge: e7ac57b9c 1664c23fa
Author: Ben Hutchings <benh@debian.org>
Date: Wed Sep 10 21:59:10 2025 +0200
Merge branch 'enable-ledtrig-input-events-as-module' into 'debian/latest'
drivers/leds/trigger: Enable LEDS_TRIGGER_INPUT_EVENTS as module
See merge request kernel-team/linux!1633
commit 1664c23fa1be2dc1b713fe7b65c55dcd74ed1b91
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Sat Sep 6 11:06:53 2025 +0200
drivers/leds/trigger: Enable LEDS_TRIGGER_INPUT_EVENTS as module
Closes: #1113681
commit e7ac57b9cb4346196d9ca2db6e8dd1c513212fdb
Merge: e2c8fb460 4fa12263c
Author: Bastian Blank <waldi@debian.org>
Date: Sat Aug 30 18:23:11 2025 +0000
Merge branch 'remove-patches-rt-support' into 'debian/latest'
Remove all remaining things for rt patches
See merge request kernel-team/linux!1626
commit 4fa12263cb157a9432897527063037d131760229
Author: Bastian Blank <waldi@debian.org>
Date: Sat Aug 30 18:23:05 2025 +0000
Remove all remaining things for rt patches
commit e2c8fb460896d8c0d82043a1c05b0fa1dc538fef
Merge: a57bc708a a5feb3c5a
Author: Bastian Blank <waldi@debian.org>
Date: Sat Aug 30 09:05:21 2025 +0000
Merge branch 'enable-mhp' into 'debian/latest'
Enable MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO
See merge request kernel-team/linux!1585
commit a5feb3c5a727999e0dc1b9a066314100cc1d604b
Author: Bastian Blank <waldi@debian.org>
Date: Sat Jul 12 14:36:30 2025 +0200
Enable MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO
commit a57bc708a782055e7074fed5a88435afff90183d
Merge: 73023b9b4 1d87a1af6
Author: Bastian Blank <waldi@debian.org>
Date: Fri Aug 29 17:59:57 2025 +0000
Merge branch 'cleanup-deps' into 'debian/latest'
Move all package build-deps to specific templates
See merge request kernel-team/linux!1591
commit 1d87a1af6a88b5582317cf542447f3e4b8a5a356
Author: Bastian Blank <waldi@debian.org>
Date: Sat Jul 26 16:54:14 2025 +0200
Build-depend on kernel-wedge for gencontrol
commit 60846dae055a4ec89a298863dcf1e362b45e979e
Author: Bastian Blank <waldi@debian.org>
Date: Sat Jul 26 16:31:17 2025 +0200
Move all package build-deps to specific templates
We can generate build-deps from our per package entries, including
correct architecture and build-profiles. Move all build-deps from our
source entry into the package entries for easier maintenance.
commit 73023b9b422f6f7a159a7d803cacf2b269b13c18
Merge: d67397b1a 194de383c
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Tue Aug 26 23:47:00 2025 +0200
Merge branch 'ipv4-regression-in-local-broadcast-routes' into 'debian/latest'
net: ipv4: fix regression in local-broadcast routes
See merge request kernel-team/linux!1623
commit 194de383c5cd5e8c22cadfc487b5f8e153a28b11
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Tue Aug 26 21:59:43 2025 +0200
net: ipv4: fix regression in local-broadcast routes
commit d67397b1a322f65ffa2c630798d24cd8946bacc2
Author: Salvatore Bonaccorso <carnil@debian.org>
Date: Tue Aug 26 21:48:06 2025 +0200
Move "Drop rc from abiname" changes to new changelog entry
commit b2a23e25783cc6225fec72db55e1e17d0dee11ac
Merge: a2614ecf9 2f94a0a15
Author: Bastian Blank <waldi@debian.org>
Date: Mon Aug 25 17:34:12 2025 +0000
Merge branch 'version-drop-rc' into 'debian/latest'
Drop rc from abiname
See merge request kernel-team/linux!1610
commit 2f94a0a150eed6620a9e10cbc981ac34ad974a54
Author: Bastian Blank <waldi@debian.org>
Date: Fri Aug 15 08:55:07 2025 +0200
Drop rc from abiname
We already publish all non-rc releases to experimental with the base
version. Also do the same for rc releases. This means we only need to
go through binary-NEW for experimental once.
commit 419df8d9d78417996683463ef109614b9914d304
Author: Bastian Blank <waldi@debian.org>
Date: Fri Aug 15 08:47:34 2025 +0200
Support version combinations of update and rc
commit 943d1bc2714afff42cabc1b759e0bc848abd287c
Author: Bastian Blank <waldi@debian.org>
Date: Fri Aug 15 08:43:53 2025 +0200
Don't export linux version modifier
commit 14317463a137c4b18354c9b16ac7cf155671b680
Author: Bastian Blank <waldi@debian.org>
Date: Fri Aug 15 08:38:36 2025 +0200
Drop support for unused DFSG versions
Among the 76 debian patches available in version 6.16.11-1 of the package, we noticed the following issues:
![[bug history graph]](https://qa.debian.org/data/bts/graphs/l/linux.png){kind=link}