Debian security updates: patch Debian 13, 12 and LTS fast

Updated November 2026

On a supported Debian release, sudo apt update && sudo apt upgrade installs every published security fix. As of November 2026 that means Debian 13 “trixie” (regular security support) or Debian 12 “bookworm” (Long Term Support). Debian 11 and older no longer get free fixes.

Supported releases

Debian security support as of November 2026
Release	Latest point release	Regular security support	Debian LTS	Status now
Debian 13 “trixie”	13.7 (September 12, 2026)	Until August 9, 2028	Until June 30, 2030	Supported (stable)
Debian 12 “bookworm”	12.15 (July 11, 2026)	Ended July 11, 2026	Until June 30, 2028	Supported by Debian LTS
Debian 11 “bullseye”	–	Ended August 14, 2024	Ended August 31, 2026	End of life (paid ELTS only)

Check which release a server runs:

cat /etc/os-release
cat /etc/debian_version

VERSION_CODENAME in /etc/os-release gives the codename (trixie, bookworm) that the security repository and debsecan use.

Check the security repository

Debian ships security fixes from a separate archive, security.debian.org. If it is missing from the APT sources, apt upgrade only installs point-release updates and you will miss urgent fixes. Look for it:

grep -rn security /etc/apt/sources.list /etc/apt/sources.list.d/

On Debian 13 the recommended format is a single /etc/apt/sources.list.d/debian.sources file. The security entry looks like this:

Types: deb
URIs: https://security.debian.org/debian-security
Suites: trixie-security
Components: main non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.pgp

On Debian 12 the classic one-line format is still common:

deb http://deb.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware

Debian LTS uses the same security archive. If a bookworm server already follows the security repository, it receives LTS fixes with no change.

Apply security updates now

sudo apt update
sudo apt upgrade

apt upgrade may install new packages to satisfy dependencies but never removes any. If it reports packages as “kept back”, sudo apt full-upgrade installs them, but it may also remove packages, so read its summary before you answer yes. In scripts use apt-get, because the apt interface can change between versions:

sudo apt-get update && sudo apt-get -y upgrade

Find what is still vulnerable: debsecan

debsecan compares installed packages with the Debian Security Tracker. Always pass the codename, not “stable”:

sudo apt install debsecan
debsecan --suite trixie --only-fixed
debsecan --suite trixie --format packages --only-fixed

The last command prints binary packages that have a fix in the archive. A fix can be listed slightly before it is built for your architecture, so an occasional package may not install yet. To install all of them after reviewing the list:

sudo apt-get install $(debsecan --suite trixie --format packages --only-fixed)

For a single CVE or package, search the Debian Security Tracker. It shows the fixed version for each release; compare it with dpkg -l package. See also Check installed versions.

Packages with limited support

A few packages get limited security support, or support that ends before the release does. check-support-status from the debian-security-support package lists installed ones:

sudo apt install debian-security-support
check-support-status

Automatic security updates

unattended-upgrades installs updates daily in the background. The default configuration installs security updates, not new features.

sudo apt install unattended-upgrades apt-listchanges
sudo dpkg-reconfigure unattended-upgrades
sudo unattended-upgrade -v --dry-run

Answer yes to the question about automatically installing stable updates. Do not edit 50unattended-upgrades in place: copy it to /etc/apt/apt.conf.d/52unattended-upgrades-local and change the copy. Logs are in /var/log/unattended-upgrades/. To let the server reboot itself at a set time when an update requires it, add:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";

Reboots the server. Automatic-Reboot restarts the machine without asking, even with users logged in. Use it only where a short outage at that time is acceptable.

More options: Automatic updates.

Restarts and kernel updates

A process keeps using the old library until it restarts, and a new kernel only runs after a reboot. needrestart checks both; once installed, it also runs automatically after each apt run.

sudo apt install needrestart
sudo needrestart -r l     # list services that need a restart, restart nothing
sudo needrestart -k       # check whether the running kernel is outdated
sudo needrestart -r i     # interactive: choose services to restart

-r a restarts affected services automatically, and -b gives machine-readable output for monitoring. Under unattended-upgrades, an interactive configuration falls back to list-only mode.

The older alternative is checkrestart from the debian-goodies package, still shipped in trixie. It lists processes that use deleted or replaced files:

sudo apt install debian-goodies
sudo checkrestart

For kernel fixes, install the update and plan a reboot (sudo reboot restarts the server). If downtime is hard to schedule, read Kernel updates and Kernel live patching. For service restarts in general, see Restarts and reboots.

DSA, DLA and where to follow them

DSA (Debian Security Advisory): Fixes for the release under regular security support, now Debian 13. Listed at debian.org/security, with RSS at https://www.debian.org/security/dsa, and mailed to debian-security-announce.
DLA (Debian LTS Advisory): Fixes from the Debian LTS team, now covering Debian 12. Listed at debian.org/lts/security, with RSS at https://www.debian.org/lts/security/dla, and mailed to debian-lts-announce.
Security Tracker: The status of every CVE in every Debian release, including issues with no fix yet.

On an end-of-life release

Debian 11 and older get no fixes from Debian. You have two options.

Upgrade. Debian supports upgrades from the previous release only, so go one step at a time: 11 to 12, then 12 to 13. Follow the release notes for each step.
Extended LTS (ELTS). A commercial service run by Freexian, not an official Debian project, that extends releases to 10 years for the packages its customers pay for. Its page lists Debian 11 until June 30, 2031 and Debian 10 until June 30, 2029. Freexian says it aims to keep access free for individuals and small non-profits on request.

Upgrading bookworm to trixie, in short (as root, inside screen or tmux if remote):

Back up at least /etc, /var/lib/dpkg, /var/lib/apt/extended_states and the output of dpkg --get-selections '*'.
Bring bookworm fully up to date: apt update && apt full-upgrade.
Change every bookworm in the APT sources to trixie (including trixie-security), or convert to debian.sources as shown above.
Run the upgrade:

apt update
apt upgrade --without-new-pkgs
apt full-upgrade
reboot          # restarts the server

Afterwards, apt autoremove clears unneeded packages, and apt modernize-sources converts old .list files to the new format. More on planning: Is my OS supported?.