Debian 12.15 released – final Bookworm point release brings security fixes and ends oldstable support

by

The Debian Project published a news item on 11 July 2026 announcing Debian 12.15, the last point release for the oldstable “Bookworm” distribution. While the release does not constitute a new major version, it updates a large number of packages, primarily to address security vulnerabilities and serious bugs.

Key highlights

  • Security‑focused updates: More than 70 packages received patches for recent CVEs, including critical fixes for 7zip, apache2, mariadb, and the Linux kernel.
  • fwupd 2.0.20: Adds the ability to update Secure Boot databases (CA, KEK, DBX). The default 2013 Secure Boot CA has expired, so users should apply OEM‑provided updates to avoid boot failures.
  • geoip‑database rollback: Reverted to a 2019‑era DFSG‑compatible version; users needing up‑to‑date GeoLite data must obtain a separate license.
  • End of official support: Debian 12 will no longer receive updates from the Release, Security, or Backports teams. Ongoing maintenance for some architectures will be handled by the Debian Long‑Term Support (LTS) team, but migration to Debian 13 “Trixie” is strongly recommended.
  • Installation media: New ISO images reflecting the point release will appear soon, but existing Bookworm media remain usable – a simple apt full-upgrade from a current mirror brings the system up to date.

What users should do

For systems that rely on Secure Boot, follow the guidance on the Debian wiki (SecureBoot/CAChanges) to apply the updated CA/KEK/DBX bundles. Users of the geoip-database package should consider switching to a licensed GeoLite source if accurate geolocation is required.

All administrators are encouraged to run a full system upgrade and verify that the new fwupd version can correctly update Secure Boot keys. After the upgrade, plan migration to Debian 13 as soon as feasible, especially for production environments that need continued security support.

Reference links