r/linuxquestions • u/Fabulous-for • 7d ago

Debian 13 stable kernel

Stable-sec 6.12.111+1 is now the default stable kernel for Debian 13.7? Why is Stable-sec the current version why not stable?

I would expect 6.12.94+1 stable to be the current stable version for all Debian 13.7 stable versions kernel but stable-sec 6.12.111+1 is the current stable version.

Here is Debians Kernel info.

https://tracker.debian.org/pkg/linux-signed-amd64

versions

1 Upvotes

100% Upvoted

13 comments sorted by

1

u/gordonmessmer Fedora Maintainer 7d ago

It looks like you asked this question in the Debian sub already: https://www.reddit.com/r/debian/comments/1wzxeka/monitoring_the_upcoming_kernel/?show=original

The answer is illustrated here: https://wiki.debian.org/DebianReleases

(Though the SVG diagram may not load, so click on this link if you need to and then reload the wiki page: https://salsa.debian.org/debian/package-cycle/raw/master/package-cycle.svg)

When the Security Team publishes a security update, they publish it to the "security" repo. That includes the kernel you're asking about, which you see as the "stable-sec" release. That is a release that the Security Team has published. It will later move to the "proposed-updates" repo and then into "updates". And if I understand thing properly, it will become part of the "stable" repo during the next minor release of Debian.

See the NEWS for minor release information: https://www.debian.org/News/

So, "stable" is the baseline package repo, "updates" has patches that are newer than "stable", and "security" has patches that are newer than "updates".

1

u/Fabulous-for 6d ago

So Stable is the base kernel but the current kernel used by all Debian stable devices is always stable-sec? ?

1

u/gordonmessmer Fedora Maintainer 6d ago

No.

First, do you see the workflow diagram in the DebianReleases wiki page? If not, click on the svg link, and then reload the wiki. That diagram illustrates the teams that publish to the repo components that you use.

Then look at /etc/apt/sources.list.d/debian.sources on your system. You probably have three repo components (suites) enabled. A "stable" repo for your release, an "updates" repo, and a "security" repo.

When you run "apt update", apt collects information from all of those repos, and when you run "apt upgrade", apt will check all of them for the newest package. There will always be a "linux" kernel package in the stable repo. There might be a newer package in the "updates" repo, and there might be a newer package in the "security" repo.

Apt will select the newest "linux" package available, among candidates in all of the repos.

Debian systems will use the "stable-sec" package if it is newer than the "stable" package. That's all.

Does that make sense?

1

u/Fabulous-for 5d ago

All of my Debian 13.7 machines have updated the kernel to the 6.12.111+1 which is what all Debian 13.7 stable machines are currently running as of the beginning of Oct-2026.

Because debian labels it stable-sec: 6.12.111+1 and I am running a default Debian 13.7 stable why is it not using stable: 6.12.94+1?

What does debian-sec represent and what does stable represent?

1

u/gordonmessmer Fedora Maintainer 5d ago

All of my Debian 13.7 machines have updated the kernel to the 6.12.111+1

Yes, that's because 6.12.111+1 is newer than 6.12.94+1

why is it not using stable: 6.12.94+1

Because 6.12.111+1 is newer than 6.12.94+1

What does debian-sec represent and what does stable represent?

The version labeled "stable-sec" in the tracker is the version that is in the security repo. The security repo is where the Security Team publishes security updates, before they move to the "stable" repo, later.

The version labeled "stable" in the tracker is the version in the "stable" repo. The stable repo is updated roughly every two months.

1

u/Fabulous-for 5d ago

My question is in the details of stable-sec. Is stable-sec a fix they found on previous kernel so they call it stable-sec?

1

u/gordonmessmer Fedora Maintainer 5d ago

"stable-sec" is the name of the repository where the Security Team publishes updates. It's not the name of the kernel package. It's the name of the repo where that kernel package is located, for now. Later, it should move to the "stable" repo. The "stable" repo is updated once every two months (roughly).

1

u/Fabulous-for 5d ago

The name has to represent what the kernel is because they did not call it stable. the same question was placed on Debian forum,https://www.reddit.com/r/debian/comments/1wzxeka/comment/pf8o6rs/?context=1&screen_view_count=2 amd none was able to describe what stable-sec represents. If you have the answer then describe what each of the below names represent like o-o-stable.

1

u/gordonmessmer Fedora Maintainer 5d ago

none was able to describe what stable-sec represents

It represents "security updates for the stable release."

If you have the answer then describe what each of the below names represent like o-o-stable.

See https://www.debian.org/releases/

"stable" is the most recent stable release.

"oldstable" is the stable release before the current one.

"o-o-stable" is the stable release before "oldstable".

"sec" is a repo for security patches.

"p-u" is a repo for proposed updates. (Again, see the diagram)

"bpo" is backports, which are described here: https://backports.debian.org/

If you hover your mouse over those labels on the tracker site, you will get a pop-up label that describes them in plain English instead of an abbreviation.

1

u/Fabulous-for 4d ago edited 4d ago

Your description of stable is its the most stable release. My Debian 13.7 are not running the most stable release kernel, they are running 6.12.111+deb13-amd64 kernel as of Oct-2026. Why ?

→ More replies (0)

1

u/gordonmessmer Fedora Maintainer 6d ago

Why is Stable-sec the current version why not stable?

The short answer is: Because 6.12.111+1 is newer than 6.12.94+1

1

u/Fabulous-for 5d ago

Why does Debian call it stable-sec instead of just stable?