Re: Question about CVE fix back-porting to bullseye and bookworm

[Moritz Mühlenhoff <jmm@inutil.org>]

On Mon, Mar 31, 2025 at 01:13:59PM -0700, Jim Hodgins wrote:
> Hi,
> 
> I am wondering if the following CVE's fixed in trixie/sid will be
> backported to bullseye and bookworm?
> 
> https://security-tracker.debian.org/tracker/CVE-2024-38541
> https://security-tracker.debian.org/tracker/CVE-2024-38564
> https://security-tracker.debian.org/tracker/CVE-2024-50061

CVE-2024-50061 is already fixed in the latest Bookworm point release.

For the other two, if you want to see them fixed, you can work
with the maintainers of the 6.1.x LTS kernel tree to accept a
backport:
https://github.com/torvalds/linux/blob/master/Documentation/process/stable-kernel-rules.rst

The subsequent Debian update will then pick up the fix since we follow
the 6.1.x series.

Cheers,
        Moritz