StackX kernels: native fixes and Linux 6.12 LTS for Debian 9, 10 and 11

StackX kernels

As with StackX PHP, the story started with a critical vulnerability.

CVE-2026-98432 affects the memory management of TCP/IPv4 options inside the Linux kernel. The flaw can lead to the use of memory that has already been freed, with consequences ranging from a server crash to potential remote compromise.

Under the immediate pressure of the vulnerability, we started by backporting the upstream fix to the native Debian 11 Bullseye kernel. The first published set was based on Linux 5.10.262, with our 5.10.262-1+sx1 revision. The Debian 9 Stretch and Debian 10 Buster ports followed after their own adaptations and validation work.

This first step was deliberately targeted: fix CVE-2026-98432 in the native kernels of all three distributions, without pretending to resume complete maintenance of Debian 9, 10 or 11.

Once the immediate emergency had been dealt with, the project could have stopped there. It did exactly the opposite.

We decided to go further and put something new under the hood: port Linux 6.12 LTS to Stretch, Buster and Bullseye so that legacy servers could benefit from a recent kernel, its protections and its security fixes, while keeping applications that are particularly difficult to migrate.

The need is very real. Some of these servers remain connected to industrial or medical systems that will never receive another update, to equipment whose protocols are hard-coded, or to applications whose migration requires far more than a simple version change.

We plan to maintain and update this kernel line through 2028. This maintenance covers the StackX kernels and their compatibility with the affected distributions. It is not a general resumption of support for these older Debian releases.

StackX kernels therefore address two different needs today: fixing CVE-2026-98432 in the native kernels of Debian 9, 10 and 11, or bringing Linux 6.12 LTS to those same systems without replacing their user space.

This is not “three generations of LTS kernels”. The mirror contains six separate package sets: three corrected native Debian branches, then three distribution-specific Linux 6.12 builds. All packages presented here target amd64.

Two options for two different needs

Stay on the corrected native kernel: the change is deliberately narrow. The package keeps the distribution’s kernel generation and adds the targeted CVE-2026-98432 backport.

Move to Linux 6.12 LTS: the system keeps its glibc, userspace headers and Debian environment, but boots a 6.12 kernel built, configured and tested separately for that distribution.

These two lines remain separate. Installing 6.12 does not turn the +sx1 packages into dependencies, and the corrected native packages do not claim to provide the features of a modern kernel.

Corrected native Debian kernels

These three sets provide a targeted backport of the CVE-2026-98432 fix. The adaptation is based on stable commit b3b027ef0cd3. IPv4 options are freed after an RCU grace period so that active readers cannot access an area that has already been released. Stretch and Buster also receive the explicit null-pointer guard required by their implementation.

The scope is deliberately precise: these +sx1 revisions fix CVE-2026-98432. They are not a general resumption of security maintenance for kernels 4.9, 4.19 or 5.10, let alone for the whole Debian release.

Linux 6.12 LTS for Stretch, Buster and Bullseye

Each distribution has its own four-package set: the image and modules, headers with the tools required for external modules, a metapackage, and a dedicated GCC 12.4 toolchain.

GCC is installed under /opt/stackx-toolchain. The global compiler and its alternatives remain unchanged. The packages replace neither the distribution’s glibc, nor linux-libc-dev, nor the headers under /usr/include.

File formats are adapted to the target system as well. Stretch keeps uncompressed .ko modules for its native tools. Buster and Bullseye use XZ. Kernel images use gzip and the initramfs is generated by Debian’s tools during installation.

Configurations were adapted to the distributions and to the selected server protections. An adaptation of Debian’s perf hardening is shipped with the sources. Some old options and drivers no longer exist unchanged in Linux 6.12. Each channel’s notes describe these differences instead of pretending to offer universal hardware equivalence.

What was verified

The corrected native kernels were built and tested inside their target distributions. Checks cover the presence of the fix in the binary, side-by-side installation with the previous kernel, boot, IPv4 and IPv6 TCP exchanges, the affected IPv4 options, and the build, load and removal of an external module.

For Linux 6.12, isolated tests include an old kernel, candidate, old kernel, then candidate boot cycle. They cover, among other things:

• networking and filtering;
• ext4 and AppArmor;
• external modules and DKMS;
• the selected perf checks;
• v1/hybrid cgroups on Stretch and Buster, and v2 cgroups on Bullseye.

The first production deployments were completed across several dozen machines running Bullseye, Stretch and Buster. The kernels were also tested on ScalarCloud Proxmox virtual machines, OVHcloud Public Cloud instances, VPS platforms, and OVHcloud dedicated servers in Europe and the United States.

This operational feedback complements the isolated test campaigns, but it does not turn them into universal qualification. The complete Debian test suite was not executed: we focused on our actual use cases, the affected hardware and the functions required by our environments.

The repositories and setup scripts were also exercised with the native APT versions from all three distributions: initial setup, repeated setup, refusal of a wrong key or corrupted index, verified download and reinstallation of the exact versions.

Installation, reboot and return to the previous kernel

The public scripts only add the APT source and its keyring, then validate the key and signed index. They install no kernel and do not reboot the machine. Simulation, installation and reboot remain explicit administrator decisions.

Before testing, keep the previous kernel and its initramfs, arrange console access, and inspect the operations proposed by APT. Do not run autoremove as part of this procedure.

After installation, verify the effective GRUB choice. A newer kernel can change menu ordering, while an older persistent selection may remain first instead. After the operator-controlled reboot:

uname -r

The result must match the expected kernel in the tables above. Then verify networking, storage, filtering, applications and external modules on the actual machine. To return, select the retained previous kernel in GRUB. No kernel needs to be removed for this round trip.

Signatures, sources and limits

The APT repositories are signed with the following key:

AF97 ED98 AACE 4CE1 29A0 3B6E 2C97 36B5 93BA BF7F

The APT signature authenticates indexes and the packages they reference. The kernel images are not signed for Secure Boot. A machine that enforces signed images at boot requires a separate signing and trust procedure.

The native sets provide the exact modified Debian sources. The 6.12 sets provide the official Linux archive, final configuration, the perf patch, toolchain sources and a build recipe. The recipe documents the build, but no bit-for-bit binary reproducibility is claimed.

These tests cover defined scenarios and environments. They do not qualify every piece of hardware, firmware, file system, proprietary driver or third-party module. A first test on the relevant hardware and applications remains essential.

Resources

Corrected native kernels:

• Debian 9 Stretch, corrected Linux 4.9
• Debian 10 Buster, corrected Linux 4.19
• Debian 11 Bullseye, corrected Linux 5.10

Linux 6.12 LTS:

• Linux 6.12 for Debian 9 Stretch
• Linux 6.12 for Debian 10 Buster
• Linux 6.12 for Debian 11 Bullseye
• StackX PHP for Debian 9, 10 and 11

Component licences and attribution are preserved.

—
Christophe Casalegno (find all my social networks at: all.bo)