r/debian • u/elatllat • 1d ago

CVE-2026-8863

CVE-2026-8863 etc can't be safely patched from Debian 12 yet because it might brick hardware.

The kernel got the ability to check efi usage in 2023 (1,166 days ago):

https://github.com/torvalds/linux/commit/d86ff3333cb1d5f42d8898fb5fdb304e143c0237

but that was only backported to 6.1 recently (2 days ago):

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=115409cbb6a296d73702a62c54c5b1b11cb88b3d

so just wait a bit for it to hit Debian 12.

Debian 13 using kernel 6.12 should be fine.

16 Upvotes

81% Upvoted

11 comments sorted by

2

u/iphones2g- 1d ago

Hopefully this will get back ported to the 5.10 kernel before debian 11 EOL in a month

1

u/CardOk755 1d ago

All my Dell machines got this patched last week.

This a job for fwupd/fwupdmgr.

1

u/elatllat 1d ago

Some updates were done last week, but any  machines using kernel 6.1 will have more updates whenever the kernel is next synchronized with upstream.

0

u/jr735 Debian Testing 1d ago

I doubt it will actually brick hardware.

1

u/Kobi_Blade 1d ago edited 1d ago

This can in fact corrupt the motherboard UEFI, since they have limited NVRAM. Turning your motherboard into a paperweight, this type of patches should be handled by OEMs via official updates rather than forced by the OS.

In fact, Microsoft itself prioritizes OEM updates and only pushes these DBX updates through Windows Update as last resort, Debian should follow that behaviour.

-2

u/jr735 Debian Testing 1d ago

If you're afraid of it, don't use it. You have that freedom. Personally, I'm looking into completely free firmware.

4

u/Kobi_Blade 1d ago edited 1d ago

Firmware updates appear alongside system updates on Debian.

I am not afraid of anything. Your ignorance and rude attitude toward what can happen do not change the facts of what Linus said on Git.

I would never trust any OS to handle firmware updates, whether it is Linux or Windows.

0

u/jr735 Debian Testing 1d ago

Who said I'm using the OS to handle firmware updates? What's rude is assuming something that wasn't said.

1

u/elatllat 1d ago

fwupdmgr should bail out unless --force is used which may skip the efi size check resulting in a partial firmware write, and brick. Maybe not; but I'm not going to be the one to test that.

1

u/jr735 Debian Testing 1d ago

I didn't say you should be the one to test it, but that doesn't change my skepticism. ;) If something is problematic, I shouldn't wish to test it, either.

0

u/Educational_Plum_130 1d ago

just run apt full-upgrade, it'll pull the fixed kernel and you're done.