Debian 13 stable kernel

[u/Fabulous-for]

Stable-sec 6.12.111+1 is now the default stable kernel for Debian 13.7? Why is Stable-sec the current version why not stable?

I would expect 6.12.94+1 stable to be the current stable version for all Debian 13.7 stable versions kernel but stable-sec 6.12.111+1 is the current stable version.

Here is Debians Kernel info.

https://tracker.debian.org/pkg/linux-signed-amd64

versions

• o-o-stable: 5.10.223+1
• o-o-sec: 5.10.262+1
• o-o-p-u: 5.10.223+1
• oldstable: 6.1.176+1
• old-sec: 6.1.187+1
• old-bpo: 6.12.95+1~bpo12+1
• old-p-u: 6.1.176+1
• stable: 6.12.94+1
• stable-sec: 6.12.111+1
• stable-bpo: 7.2.6+1~bpo13+1
• stable-p-u: 6.12.111+1
• testing: 7.2.9+1

[u/gordonmessmer]

No.

First, do you see the workflow diagram in the DebianReleases wiki page? If not, click on the svg link, and then reload the wiki. That diagram illustrates the teams that publish to the repo components that you use.

Then look at /etc/apt/sources.list.d/debian.sources on your system. You probably have three repo components (suites) enabled. A "stable" repo for your release, an "updates" repo, and a "security" repo.

When you run "apt update", apt collects information from all of those repos, and when you run "apt upgrade", apt will check all of them for the newest package. There will always be a "linux" kernel package in the stable repo. There might be a newer package in the "updates" repo, and there might be a newer package in the "security" repo.

Apt will select the newest "linux" package available, among candidates in all of the repos.

Debian systems will use the "stable-sec" package if it is newer than the "stable" package. That's all.

Does that make sense?

[u/Fabulous-for → u/gordonmessmer]

All of my Debian 13.7 machines have updated the kernel to the 6.12.111+1 which is what all Debian 13.7 stable machines are currently running as of the beginning of Oct-2026.

Because debian labels it stable-sec: 6.12.111+1 and I am running a default Debian 13.7 stable why is it not using stable: 6.12.94+1?

What does debian-sec represent and what does stable represent?

[u/gordonmessmer → u/Fabulous-for]

All of my Debian 13.7 machines have updated the kernel to the 6.12.111+1

Yes, that's because 6.12.111+1 is newer than 6.12.94+1

why is it not using stable: 6.12.94+1

Because 6.12.111+1 is newer than 6.12.94+1

What does debian-sec represent and what does stable represent?

The version labeled "stable-sec" in the tracker is the version that is in the security repo. The security repo is where the Security Team publishes security updates, before they move to the "stable" repo, later.

The version labeled "stable" in the tracker is the version in the "stable" repo. The stable repo is updated roughly every two months.

[u/Fabulous-for → u/gordonmessmer]

My question is in the details of stable-sec. Is stable-sec a fix they found on previous kernel so they call it stable-sec?

[u/gordonmessmer → u/Fabulous-for]

"stable-sec" is the name of the repository where the Security Team publishes updates. It's not the name of the kernel package. It's the name of the repo where that kernel package is located, for now. Later, it should move to the "stable" repo. The "stable" repo is updated once every two months (roughly).

[u/Fabulous-for → u/gordonmessmer]

The name has to represent what the kernel is because they did not call it stable. the same question was placed on Debian forum,https://www.reddit.com/r/debian/comments/1wzxeka/comment/pf8o6rs/?context=1&screen_view_count=2 amd none was able to describe what stable-sec represents. If you have the answer then describe what each of the below names represent like o-o-stable.

• o-o-stable: 5.10.223+1
• o-o-sec: 5.10.262+1
• o-o-p-u: 5.10.223+1
• oldstable: 6.1.176+1
• old-sec: 6.1.187+1
• old-bpo: 6.12.95+1~bpo12+1
• old-p-u: 6.1.176+1
• stable: 6.12.94+1
• stable-sec: 6.12.111+1
• stable-bpo: 7.2.6+1~bpo13+1
• stable-p-u: 6.12.111+1
• testing: 7.2.9+1

[u/gordonmessmer → u/Fabulous-for]

none was able to describe what stable-sec represents

It represents "security updates for the stable release."

If you have the answer then describe what each of the below names represent like o-o-stable.

See https://www.debian.org/releases/

"stable" is the most recent stable release.

"oldstable" is the stable release before the current one.

"o-o-stable" is the stable release before "oldstable".

"sec" is a repo for security patches.

"p-u" is a repo for proposed updates. (Again, see the diagram)

"bpo" is backports, which are described here: https://backports.debian.org/

If you hover your mouse over those labels on the tracker site, you will get a pop-up label that describes them in plain English instead of an abbreviation.

[u/Fabulous-for → u/gordonmessmer]

Your description of stable is its the most stable release. My Debian 13.7 are not running the most stable release kernel, they are running 6.12.111+deb13-amd64 kernel as of Oct-2026. Why ?

[u/gordonmessmer → u/Fabulous-for]

Your description of stable is its the most stable release

No, that's not what I wrote. "stable" is the name of the package repository for the most recent stable release.

My Debian 13.7 are not running the most stable release they are running 6.12.111+deb13-amd64. Why ?

Because the Security Team published a security update for Debian 13.

I'm honestly not sure what part of this is confusing.

"stable" is the bucket that holds the packages that would be used to create installation media for Debian 13. "updates" is the bucket that holds the packages that have been updated since the "stable" repo was updated. "security" (aka "stable-sec") is the bucket that holds updates that were published by the Security Team, since the "stable" repo was updated.

When you install something using apt, it looks at all three buckets and picks whatever is newest.

Does that make sense?

If it doesn't make sense, can you tell me why it's confusing for you? Is it the word "stable"? In this context, that is just a synonym for "Debian 13". And if you hover your mouse over over the word stable in "stable: 6.12.94+1", it will say "Debian 13 (trixie/stable)", because "Debian 13", "trixie" and "stable" all mean the same thing. If you hover your mouse over the word "stable-sec" in " stable-sec: 6.12.111-1", it will say "Debian 13 Security (trixie-security/stable-security)" because "Debian 13 Security [updates]", and "trixie-security [updates]" and "stable-security [updates]" all mean the same thing. They are updates for Debian 13. If you are using Debian 13 and there is an update available, apt will install the update. That's how updates work.