Linux Kernel CVE-2025-40203

Upstream fix available (commit); a specific tagged patched-release version is not independently confirmed from the provided data - apply the vendor stable-kernel update that incorporates commits 659874b7ee4976ad9ce476e07fd36bc67b3537f1, 9c80da26fda2fdcaac7f92b5908875b3108830ff, or c1f86d0ac322c7e77f6f8dbd216c65d39358ffc0 (see https://git.kernel.org/stable/c/659874b7ee4976ad9ce476e07fd36bc67b3537f1). Track your distribution's security advisory for the exact fixed package version and reboot into the patched kernel. As a compensating control where patching must be delayed, restrict local access on multi-tenant hosts and consider constraining mount-namespace usage - for example, disabling unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0 on kernels that support it) to reduce the population of users who can construct the mount states reached via listmount(); note this can break container runtimes and sandboxes (Docker rootless, Chromium/Flatpak sandboxes) that rely on unprivileged user namespaces. A seccomp policy blocking the listmount() syscall for untrusted workloads is a narrower alternative but requires the syscall not be needed by those workloads.