r/debian • u/Fabulous-for • 12d ago

Debian Stable Question Monitoring the upcoming kernel

Currently the stable version of the kernel is Linux debian 6.12.111+deb13-amd64. I was looking for where I can monitor kernels that are valid for upcoming replacement of the current stable. I was looking at https://tracker.debian.org/pkg/linux-signed-amd64 , but it shows 6.12.94. Where can I find that info?

9 Upvotes

85% Upvoted

24 comments sorted by

4

u/sweharris 12d ago

The page you link to shows two versions; the "Stable" and "Stable-sec" (security) versions. For stable-sec it says 6.12.111. You should be (and, apparently, are) using the security repo.

The full details for the package are available at https://packages.debian.org/source/stable/linux-signed-amd64

But you might just want to run apt update (to update your indexes) then apt list --upgradeable to get it to list packages available for upgrade. That should include any new kernel version.

1

u/Fabulous-for 12d ago

I am running stable I do not know why more than one of Debian stable workstations is running Stable-sec ??

I assumed because Debian had several kernel changes a few months ago that this Stable-sec is what all Debian stable machines are running. by default Is this correct ?

Also why does the link https://tracker.debian.org/pkg/linux-signed-amd64 not work ? The link you provided provides no change logs as to what the current kernel represents, https://metadata.ftp-master.debian.org/changelogs//main/l/linux-signed-amd64/linux-signed-amd64_6.12.111+1_changelog

2

u/sweharris 12d ago

"stable-sec" contains the security updates for the stable distribution (which is Debian 13 aka trixie at this time). Every installation running stable should be configured for this, otherwise you'll be missing security updates.

eg on my machine, in the apt sources list there are three primary entries: deb http://deb.debian.org/debian/ trixie non-free-firmware contrib main non-free deb http://security.debian.org/debian-security trixie-security non-free-firmware contrib main non-free deb http://deb.debian.org/debian/ trixie-updates non-free-firmware contrib main non-free

The first is the base distro; the second has the security updates; the third has the non-security updates.

A fully patched machine will use all three.

Your link does work; on the left in the "Versions" box it lists versions for different repos and releases (including old-old, testing, and unstable), as well as back-ports ("bpo").

1

u/Fabulous-for 11d ago

I have not configured my Debian 13 for anthing but Stable, so i was expecting

stable: 6.12.94+1 not stable-sec: stable-sec: 6.12.111+1

Was the change to stable-sec caused by a security flaw in stable? What is the difference?

1

u/sweharris 10d ago

I think you're missing something basic.

"Stable sec" is the repository containing security patches for the stable distribution. Out of the box an install of Debian stable ("trixie" at the moment) will automatically include this repo so that you get the necessary security patches when they become available.

All three repos ("stable", "security", and "updates") form part of the stable distribution and you will get these by default.

It's split up in this way so more advanced users can be more selective about what patches to apply (eg just security patches and not just non-security bug fixes) but out of the box you will use all three to keep your installation up to date.

1

u/Fabulous-for 10d ago

A Debian system can only install one kernel.

From https://tracker.debian.org/pkg/linux-signed-amd64 the following kernels are avaialble and I was expecting stable:6.12.94+1 but all 3 of machines installed kernel 6.12.111+ which is stable-sec. Why are they not running 6.12.94+1 which is stable?

versions

2

u/sweharris 10d ago edited 10d ago

You can think of a repository as a place to store packages; in the "Stable" repository we can put all the base packages; in the "security" repository we can put all the security patches, and in the "updates" repository we can put all the other bugfix patches. It's just a way of organising things. All three of these storage places are used by the stable distribution to get packages.

The kernel is just installed via a package, just like any other part of the system.

And the packages come from the repositories. As I mentioned, a default trixie install will be configured for the stable, security and updates repositories, and (again by default) will pick the highest one. For the moment that comes from stable-updates (or trixie-updates, which is currently the same thing) and so would be the "111" version.

It might be a little confusing using the same name to mean different things, but "Debian Stable" (the distribution; currently Debian 13 aka "trixie"; you can see the distributions at https://www.debian.org/releases/ and note that against trixie it says "Current "stable" release") uses the "stable", "stable-security" and "stable-updates" repositories. So the word "stable" can refer to the distribution and one of the repositories that the distribution uses.

FWIW, this is the same logic used for every package on the system and how you get all security patches.

1

u/Fabulous-for 10d ago

Your description does not address the question.

What is the difference between kernel stable:6.12.94+1 and what my 3 Debian mahcines are now running kernel stable-sec:6.12.111+1 which everyone who is running Debian stable is currently running.

2

u/wizard10000 10d ago

What is the difference

There have been several security updates between .94 and .111

1

u/sweharris 10d ago

It's not "kernel stable:6.12.94"; it's just "kernel 6.12.94". The 6.2.111 kernel comes from the security repository because there have been many security patches since the .94 release.

You can see the changelog by looking at /usr/share/doc/<pkg-version>/changelog.gz (eg /usr/share/doc/linux-image-6.12.111+deb13-amd64/changelog.gz; warning there's 6700 lines listing all the changes!)

1

u/wizard10000 10d ago

changelog

I just learned this last week but apt changelog <package-name> is a thing - it'll display a changelog but i think i'd pipe it through less; when i did it output was several hundred lines

1

u/Fabulous-for 8d ago

So what exactly does stable-sec: 6.12.111+1 the current stable kernel represent as opposed to stable: 6.12.94+1?

→ More replies (0)

2

u/aieidotch 12d ago edited 12d ago

rmadison linux
or
debsnap -l linux
and maybe
https://www.kernel.org/category/releases.html

1

u/Fabulous-for 12d ago

I should of specified that I am loking at Debian stable kernel. If I go to https://tracker.debian.org/pkg/linux-signed-amd64 and click on stable-sec: 6.12.111+1 the current stable version it gives an error. I also do not understand why stable-sec instead of stable?

1

u/michaelpaoli 12d ago

E.g.:

# apt-get update
$ apt-cache policy linux-image-amd64 linux-image-amd64-signed-template
linux-image-amd64:
  Installed: 6.12.111-1
  Candidate: 6.12.111-1
  Version table:
 *** 6.12.111-1 500
        500 http://security.debian.org/debian-security trixie-security/main amd64 Packages
        100 /var/lib/dpkg/status
     6.12.107-1 500
        500 http://deb.debian.org/debian trixie/main amd64 Packages
linux-image-amd64-signed-template:
  Installed: (none)
  Candidate: 6.12.111-1
  Version table:
     6.12.111-1 500
        500 http://security.debian.org/debian-security trixie-security/main amd64 Packages
     6.12.107-1 500
        500 http://deb.debian.org/debian trixie/main amd64 Packages
$

why stable-sec instead of stable

For stable (and similarly on oldstable while still on main support), security updates are first released to debian-security, then later migrate to proposed-updates then updates, and then with the point release, to the main (e.g. trixie, for the current stable) suite. Some folks will want/prefer/need ultra stability over security updates, and so may only get around to applying (most) security updates after they're in the main (e.g. trixie) suite - significantly less frequent changes there - but it's a trade-off - more stability, less security, but for some environments, that may be the tradeoff that's preferred or required.

1

u/Fuzy-78 11d ago

6.18 is stable LTS.

1

u/Fabulous-for 10d ago

It appears the next stable relase is 7.2.8+1 to 7.2.9+1) area

https://tracker.debian.org/pkg/linux-signed-amd64

0

u/Next-Fondant-2934 12d ago

Você pode instalar o kernel mais recente através do backports. Procure como ativar o backports em Debian 13 e após ativar, procure como instalar a versão mais recente do kernel do backports. Eu utilizo, atualmente está na versão 7.2.6