Linux CVE-2025-38436

Update the Linux kernel to a version incorporating the upstream fix. The primary remediation is to apply kernel security updates from the stable tree branches; check your distribution's kernel update channel for patched versions corresponding to the commits referenced (471db2c2d4f, 8342127a8a6, aa382a8b6ed, aefd0a9356, c5734f9bab6). For systems unable to immediately patch, implement process isolation and resource limits: use cgroups and namespace isolation to prevent cross-application GPU job dependency chains (separate cgroups for unrelated applications), disable GPU sharing between untrusted applications where feasible, and implement application health monitoring and restart policies to mitigate hangs. Set aggressive application watchdog timeouts (e.g., cgroup memory.memsw.limit_in_bytes, systemd service restarts) so that hanging applications are automatically terminated and restarted rather than blocking system resources indefinitely. These compensating controls reduce availability impact but do not address the underlying vulnerability and may mask other issues causing legitimate long-running GPU workloads.