By ByteBot
Debian 13.6 landed July 11 with 244 fixes — the kind of point release you’d normally apply on a quiet Tuesday and forget about. Don’t. Buried in the package list is a Secure Boot CA transition that sets a countdown timer on every Debian machine with Secure Boot enabled. Miss the update window, and the next shim package from Debian will refuse to boot your machine.
The Secure Boot Problem That Doesn’t Hurt Yet
The Microsoft Corporation UEFI CA 2011 expired on June 27, 2026. It’s the certificate chain that signs the Linux shim on most hardware shipped in the last decade. If you’re wondering why your machine still boots fine: UEFI firmware doesn’t check certificate expiration on keys already enrolled in the Secure Boot database. Your current shim is grandfathered in.
The trap springs on the next update. Once Debian ships a shim build signed exclusively under Microsoft’s newer 2023 CA — which it will, because maintaining a bootloader chain on an expired certificate is not a long-term plan — any machine that hasn’t enrolled the 2023 CA in its firmware will fail to boot post-update.
Debian 13.6 handles the package side: fwupd is updated to 2.0.20, which gains the ability to push CA, Key Exchange Key (KEK), and DBX revocation updates to firmware. The shim and shim-signed packages are now dual-signed under both the 2011 and 2023 CAs as a bridge. But the firmware side is on you. Check your hardware vendor’s tools and apply OEM CA/KEK/DBX updates. The Debian wiki has the step-by-step guidance.
Servers and workstations with Secure Boot disabled are unaffected by this specific issue. Everyone else: this is not a drill.
The Other 243 Reasons to Update
Even if Secure Boot never crosses your mind, Debian 13.6 consolidates over 130 Debian Security Advisories — DSA-6250 through DSA-6384 — into a single installable state. The breadth is notable:
- curl: 13 CVEs patched, covering bearer token leaks on redirects, credential exposure during redirect chains, connection reuse across STARTTLS sessions, and a use-after-free in the SMB implementation.
- apache2: 13 CVEs, including use-after-free bugs, buffer overflows, a cross-site scripting hole, denial-of-service conditions, and out-of-bounds reads.
- QEMU: Bumped to a new upstream stable release carrying 25 security fixes. If you run VMs on Debian — and you probably do — this matters.
The longer list covers the Linux kernel, Chromium, Firefox ESR, Thunderbird, nginx, PostgreSQL, OpenSSL, Samba, bind9, OpenVPN, rsync, Redis, ImageMagick, and FFmpeg. This is a production-critical update on security grounds alone, regardless of Secure Boot configuration. The official Debian release announcement has the full package list.
The GeoIP Rollback You’ll Notice Later
The quietest change in Debian 13.6 has the longest tail. The geoip-database package has been reverted to a snapshot from approximately December 2019.
The reason is licensing: MaxMind updated their GeoLite2 terms in late 2019 to require individual account registration. Newer data isn’t compatible with the Debian Free Software Guidelines. Debian made the right call by its own principles — and the practical result is that any application relying on the system-provided GeoIP database now gets IP allocation data from seven years ago.
If your application does geolocation — rate limiting by country, fraud detection, content localization — verify what you’re reading from. Get a GeoLite license directly from MaxMind and manage your own database updates. Continuing to use the Debian package means working with data from before the pandemic reshuffled global IP allocations.
Bookworm Gets Its Final Regular Update
Debian also released 12.15 the same day — the fifteenth and final regular point release for Debian 12 “Bookworm.” It includes 88 stability fixes and 97 security updates. More significantly, Bookworm officially transitioned to Long Term Support on July 12, with security maintenance now handled by the LTS team through June 2028.
If you’re still running Bookworm in production, that’s a supported choice through 2028. Confirm your security sources are aligned with the LTS team’s cadence — it differs from the main security team’s release rhythm. The official LTS handover announcement has the details.
How to Apply Debian 13.6
For Trixie systems, the update is a single command:
sudo apt update && sudo apt full-upgradeIf you’ve been running regular security updates from trixie-security, the delta is small — most patches are already installed and 13.6 consolidates them into the point release. On bare-metal production systems, take a snapshot first.
For Secure Boot-enabled systems: don’t stop at the apt upgrade. Apply your OEM’s CA/KEK/DBX updates via whatever firmware management path your hardware supports — fwupd handles this on most modern hardware after the 2.0.20 update. Do it now, before Debian ships the next shim update that drops the old CA chain entirely.
