Linux Kernel CVE-2025-40074

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the stable-tree commits referenced at git.kernel.org (6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8 and 923e0734c386984d45de508528a7a7ad91d791cc) by updating to the stable kernel release that includes them, or install your distribution's patched kernel package once published and reboot. Because the vulnerable functions are core IPv4 datapath code, there is no clean feature-level disable; as partial compensating controls, restrict exposure to untrusted IPv4 fragmented traffic (e.g., drop or reassemble fragments at a firewall with a conntrack/defrag policy) and avoid running IPv4 multicast routing (ipmr) where it is not needed, since disabling multicast forwarding removes the ipmr transmit paths from reach - noting these controls reduce but do not eliminate the ICMP and fragment-handling attack surface and may break legitimate multicast or fragmented-traffic workloads. Track your distribution's security advisory for the exact fixed package version rather than relying on a hand-picked version number.