How to Install Mainline Linux Kernel on Debian 13 or 12 with Zabbly

Debian stable is excellent at staying predictable, but that same conservatism can leave newer GPUs, Wi-Fi chipsets, and laptop platforms waiting on backports or the next release. To install a mainline Linux kernel on Debian, the Zabbly kernel project publishes the latest stable mainline branch through APT while leaving Debian’s stock kernel in GRUB as your fallback.

That makes this approach useful on desktops, workstations, and lab systems that need newer hardware enablement or mainline kernel behavior before Debian’s default APT sources get there. Zabbly’s current availability list names Debian 13 (Trixie) and Debian 12 (Bookworm); Debian 11 (Bullseye) is best treated as a legacy case because it is no longer listed as a current target even though the repository still exposes an amd64 package index. Plan on a full reboot-and-rollback decision because Secure Boot, DKMS modules, and GRUB fallback behavior usually decide whether a mainline kernel stays in place.

Install Mainline Linux Kernel on Debian

To install a mainline Linux kernel on Debian, add the Zabbly APT repository and install the linux-zabbly metapackage. That pulls in the matching kernel image and headers together, while Debian’s stock kernel remains installed for rollback from GRUB.

Step 1: Refresh APT Metadata and Note Your Current Debian Kernel

Start with a metadata refresh so APT sees the current Debian packages before you add a second kernel source.

sudo apt update

These commands use sudo for tasks that need root privileges. If your account does not have sudo access yet, follow the guide on how to add a user to sudoers on Debian.

Record the kernel you are running now so you can confirm the change after the reboot.

uname -r

6.12.88+deb13-amd64

Debian’s default APT sources currently track the 6.12.x kernel series on Debian 13, 6.1.x on Debian 12, and 5.10.x on Debian 11. If you only need Debian’s normal stock-kernel updates, keep using Debian’s standard system upgrade workflow. Use apt-cache policy linux-image-amd64 when you need the exact package candidate for your release before comparing it with Zabbly.

Step 2: Confirm Your Debian Architecture and Secure Boot Requirements

Zabbly writes the repository file for your package architecture, so check that first before you add the source.

dpkg --print-architecture

amd64

Zabbly’s current documentation lists Debian 13 and Debian 12 for amd64 and arm64. The Bullseye repository still exposes amd64 packages, but Debian 11 is no longer listed in the current availability table and its arm64 package index has no linux-zabbly package, so Debian 11 readers should stay on Debian’s stock kernel or upgrade from Debian 11 to Debian 12 first. If Secure Boot is enabled in firmware, disable it before booting a Zabbly kernel because these packages are not Microsoft-signed.

Step 3: Install Debian Repository Prerequisites

Install the small toolset needed to fetch the signing key, verify its fingerprint, and refresh HTTPS package sources. Most Debian desktop installs already have these packages, but minimal, cloud, and lab images often do not.

sudo apt install ca-certificates curl gpg -y

ca-certificates handles HTTPS trust, curl downloads the key, and gpg displays the fingerprint from the installed keyring file before the repository is enabled. For more detail on the download flags, see our curl command guide.

Step 4: Add the Zabbly Kernel Repository on Debian

Import the signing key first, verify the installed key fingerprint, then write the DEB822 source file with your live Debian codename and architecture.

sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSLo zabbly.asc https://pkgs.zabbly.com/key.asc
sudo install -m 0644 zabbly.asc /etc/apt/keyrings/zabbly.asc
rm -f zabbly.asc
gpg --quiet --show-keys --with-fingerprint /etc/apt/keyrings/zabbly.asc

pub   rsa3072 2023-08-23 [SC] [expires: 2030-08-17]
      4EFC 5906 96CB 15B8 7C73  A3AD 82CC 8797 C838 DCFD
uid                      Zabbly Kernel Builds <info@zabbly.com>
sub   rsa3072 2023-08-23 [E] [expires: 2030-08-17]

Continue only if the installed key fingerprint matches 4EFC 5906 96CB 15B8 7C73 A3AD 82CC 8797 C838 DCFD. If it does not match, remove /etc/apt/keyrings/zabbly.asc and do not add the repository.

. /etc/os-release
printf '%s\n' \
"Enabled: yes" \
"Types: deb" \
"URIs: https://pkgs.zabbly.com/kernel/stable" \
"Suites: $VERSION_CODENAME" \
"Components: main" \
"Architectures: $(dpkg --print-architecture)" \
"Signed-By: /etc/apt/keyrings/zabbly.asc" | sudo tee /etc/apt/sources.list.d/zabbly-kernel-stable.sources > /dev/null

The sudo tee form matters here because shell redirection with > would still run as your regular user, not as root. Writing the file through tee lets the command create the source file with elevated privileges in one step.

Check the generated source file before you refresh the package cache.

cat /etc/apt/sources.list.d/zabbly-kernel-stable.sources

Enabled: yes
Types: deb
URIs: https://pkgs.zabbly.com/kernel/stable
Suites: trixie
Components: main
Architectures: amd64
Signed-By: /etc/apt/keyrings/zabbly.asc

Now refresh APT and confirm that Debian sees the new metapackage.

sudo apt update

Relevant lines include the Zabbly InRelease file and the architecture-specific package index:

Get:4 https://pkgs.zabbly.com/kernel/stable trixie InRelease [15.4 kB]
Get:5 https://pkgs.zabbly.com/kernel/stable trixie/main amd64 Packages [9163 B]

apt-cache policy linux-zabbly

Relevant lines include a candidate from pkgs.zabbly.com:

linux-zabbly:
  Installed: (none)
  Candidate: 202605192322~amd64~debian13
  Version table:
     202605192322~amd64~debian13 500
        500 https://pkgs.zabbly.com/kernel/stable trixie/main amd64 Packages
     202605161300~amd64~debian13 500
        500 https://pkgs.zabbly.com/kernel/stable trixie/main amd64 Packages

The build stamp changes as Zabbly publishes newer kernels. Debian 12 shows the same layout with bookworm in the repository path and a Debian 12 package suffix. Treat Debian 11 as legacy even when a Bullseye amd64 candidate appears, because Zabbly’s current availability list no longer names it as a supported target.

Step 5: Install the linux-zabbly Metapackage

Install the metapackage once the repository looks correct. Review the transaction before confirming, because the Zabbly repository can also upgrade linux-libc-dev alongside the image and headers.

sudo apt-get install linux-zabbly

Relevant transaction lines include the Zabbly image, matching headers, and any development package changes:

The following additional packages will be installed:
  linux-headers-7.0.9-zabbly+ linux-image-7.0.9-zabbly+ linux-libc-dev
The following NEW packages will be installed:
  linux-headers-7.0.9-zabbly+ linux-image-7.0.9-zabbly+ linux-zabbly
The following packages will be upgraded:
  linux-libc-dev

That dependency layout is why linux-zabbly is the right package to document. You track one metapackage, APT handles the matching image and headers underneath it, and rollback includes restoring linux-libc-dev to Debian’s own package when that dependency changed.

Step 6: Reboot Into the New Debian Kernel

The new kernel is installed on disk now, but Debian will keep running the old one until the next boot.

sudo reboot

The first boot after a kernel install can take a little longer than a routine restart while GRUB and initramfs changes settle in. Give the machine a normal reboot cycle before you start troubleshooting.

Step 7: Verify the Running Zabbly Kernel on Debian

Confirm the running kernel first, then check that the matching headers are installed for the live kernel string.

uname -r

7.0.9-zabbly+

test -d "/usr/src/linux-headers-$(uname -r)" && echo "headers match the running kernel"

headers match the running kernel

That header check matters for DKMS-managed modules such as NVIDIA and VirtualBox. If the directory for the active uname -r string exists under /usr/src, the header side of the install is aligned correctly.

Zabbly installs the running kernel image and matching headers, not a full kernel source tree. DKMS driver builds normally need headers; full kernel source workflows are a separate packaging task.

Compare Debian Kernel Choices

Zabbly is not the only path to a newer kernel on Debian, so it helps to decide whether you want a mainline-style build, Debian’s default branch, or a kernel tuned for a narrower workload. Zabbly’s advantage is that it stays close to upstream Linux instead of aiming for gaming or low-latency desktop tweaks.

Kernel choice	What it tracks	Best fit	Main trade-off
Debian stock kernel	Debian’s default APT sources	Servers, conservative desktops, and systems that value long-tested packages	You stay on Debian’s kernel series for your release
Zabbly mainline kernel	Current upstream stable mainline branch	Newer hardware, lab systems, and users who want mainline behavior through APT	Secure Boot is unsupported, and regressions arrive sooner than on Debian stable
Install Liquorix kernel on Debian	Desktop-focused tuned kernel	Low-latency audio, fast desktop response, and interactive workloads	More aggressive tuning than many server or general-purpose systems need
Install XanMod kernel on Debian	Performance-focused custom branch	Gaming, multimedia, and users who want extra scheduler and networking tweaks	More opinionated patch set than Zabbly or Debian stock

If your goal is just newer upstream hardware support with as little extra tuning as possible, Zabbly is the cleanest fit. If you mainly want desktop latency or gaming tweaks, Liquorix or XanMod are better matches than a straight mainline build.

Update or Remove the Zabbly Kernel on Debian

Update the Zabbly Kernel on Debian

When Zabbly publishes a newer kernel, ask APT to install the metapackage again so it can pull in the next image and header pair. Keep the command interactive so you can review whether linux-libc-dev or another development package changes at the same time.

sudo apt update && sudo apt-get install linux-zabbly

Possible outcomes include no change or a new image/header pair:

linux-zabbly is already the newest version
or
The following NEW packages will be installed:
  linux-headers-7.0.9-zabbly+ linux-image-7.0.9-zabbly+
The following packages will be upgraded:
  linux-libc-dev

Reboot after the update so uname -r switches to the new kernel. If you want Debian to handle routine package maintenance in the background, see how to configure unattended-upgrades on Debian.

Remove the Zabbly Kernel from Debian

Removal is straightforward, but do not purge the Zabbly packages while you are booted into the Zabbly kernel. Boot a normal Debian kernel first, then remove the packages and repository.

Boot a Stock Debian Kernel First

Reboot, open Advanced options for Debian GNU/Linux in GRUB, and choose a kernel entry that does not contain zabbly. Once the system is back up, confirm that you are on Debian’s kernel again.

uname -r

6.12.88+deb13-amd64

List the Installed Zabbly Packages

Check the package names first so you can see exactly what the metapackage pulled in.

dpkg-query -W -f='${binary:Package}\t${db:Status-Abbrev}\t${Version}\n' 'linux-zabbly' 'linux-image-*-zabbly*' 'linux-headers-*-zabbly*' 2>/dev/null | sort

linux-headers-7.0.9-zabbly+  ii   7.0.9-amd64-202605182147-debian13
linux-image-7.0.9-zabbly+    ii   7.0.9-amd64-202605182147-debian13
linux-zabbly                  ii   202605192322~amd64~debian13

Purge the Zabbly Kernel Packages

This purge command reads the installed package names from dpkg and passes them to APT. That matters because apt purge linux-image-*-zabbly+ does not expand the way many readers expect.

dpkg-query -W -f='${binary:Package}\n' 'linux-zabbly' 'linux-image-*-zabbly*' 'linux-headers-*-zabbly*' 2>/dev/null | xargs -r sudo apt-get purge

Relevant removal lines include only the Zabbly metapackage, image, and headers:

The following packages will be REMOVED:
  linux-headers-7.0.9-zabbly+* linux-image-7.0.9-zabbly+* linux-zabbly*
0 upgraded, 0 newly installed, 3 to remove and 49 not upgraded.

Remove the Repository and Verify Cleanup

Delete the source file and key, then refresh APT so Debian stops offering the package.

sudo rm -f /etc/apt/sources.list.d/zabbly-kernel-stable.sources /etc/apt/keyrings/zabbly.asc
sudo apt update

APT should stop finding the metapackage once the repository is gone.

apt-cache show linux-zabbly

E: No packages found

Restore Debian’s linux-libc-dev Package

If the install transaction upgraded linux-libc-dev from the Zabbly repository, downgrade it back to the Debian package after the Zabbly source has been removed. The installed Zabbly version can remain the candidate until you name the Debian repository version explicitly.

debian_linux_libc_dev=$(apt-cache policy linux-libc-dev | awk '/^[[:space:]]{5}[0-9A-Za-z:.+~_-]/ {version=$1; sub(/^\*\*\*/, "", version)} /(http|https):\/\// && $0 !~ /dpkg\/status/ && version {print version; exit}')
if [ -n "$debian_linux_libc_dev" ]; then
  sudo apt-get install --allow-downgrades "linux-libc-dev=${debian_linux_libc_dev}"
else
  echo "No Debian linux-libc-dev candidate found; check your APT sources."
fi

The following packages will be DOWNGRADED:
  linux-libc-dev

Finish with a package-health check after the downgrade.

sudo apt-get check
sudo dpkg -C

Troubleshoot Zabbly Kernel Issues on Debian

The Zabbly kernel usually behaves like any other Debian-installed kernel, so most problems come down to boot policy, DKMS rebuilds, or a regression you can confirm in the boot log.

Boot Debian’s Stock Kernel When the Zabbly Kernel Fails

If the new kernel hangs, panics, or leaves hardware unusable, fall back to Debian’s last working kernel from GRUB before you decide whether to purge Zabbly.

1. Reboot the system and open the GRUB menu.
2. Select Advanced options for Debian GNU/Linux.
3. Choose the newest kernel entry that does not contain zabbly.
4. Once the system is back up, run uname -r and decide whether you want to keep Zabbly installed or remove it.

Fix Secure Boot Errors With the Zabbly Kernel

If the machine rejects the new kernel before Linux starts, the firmware is usually still enforcing Secure Boot.

The firmware screen may show an error like this:

Secure Boot Violation
Invalid signature detected. Check Secure Boot Policy in Setup

Zabbly’s kernels are not Microsoft-signed, so firmware that requires Secure Boot signatures will block them. Disable Secure Boot in your firmware settings, then boot the Zabbly kernel again.

Fix DKMS Module Failures After a Zabbly Kernel Update

Out-of-tree modules such as NVIDIA rely on DKMS to rebuild against the new kernel headers. If graphics, virtualization, or storage modules stop loading, check DKMS status first.

dkms status

If a line for the active Zabbly kernel is stuck at built instead of installed, the module compiled but did not finish installing for the running kernel. Trigger the rebuild again, then recheck the status.

sudo dkms autoinstall
dkms status

The target state is an installed entry for the active uname -r kernel. If the module still does not install, work through your vendor-specific steps next. For the common Debian desktop case, see how to install NVIDIA drivers on Debian.

Inspect Debian Kernel Logs After a Zabbly Boot

When the system boots but hardware or drivers still misbehave, filter the current boot log for obvious warnings and failures first.

journalctl -k -b | grep -iE "error|fail|warn" | head -20

Example output can include hardware-specific lines like these:

kernel: ACPI Error: AE_NOT_FOUND, Evaluating _DSM
kernel: nvidia: module verification failed: signature
kernel: usb 1-2: device descriptor read/64, error -71

ACPI warnings are often firmware noise, the NVIDIA signature line points back to Secure Boot or DKMS, and repeated USB errors usually mean the newer kernel exposed a hardware quirk. The grep -iE flags keep the scan case-insensitive and allow the compact error pattern used in the diagnostic.

Conclusion

A Zabbly mainline kernel is now running on Debian, while Debian’s stock kernel stays available in GRUB as a fallback. If you want quieter maintenance after the install, configure unattended-upgrades on Debian next, and if you want an easier rollback point before the next kernel jump, install Timeshift on Debian.