Linux Kernel CVE-2026-23305

Vendor-released patch: upgrade to Linux 6.18.17, 6.19.7, or 7.0-rc1 or later, which contain the matched commits (34f4495a7f72, eeaf28c8f4de, 7fc4b49474c8) that correctly decrement the core counter and invoke rocket_device_fini() on the first-core failure path. Distribution users should track the Debian security tracker and apply vendor kernel updates as they ship for the 8 tracked releases. As a compensating control on systems without Rockchip NPU hardware, blacklist the rocket module (echo 'blacklist rocket' >> /etc/modprobe.d/blacklist-rocket.conf followed by update-initramfs) to prevent the driver from probing entirely - the trade-off is loss of NPU acceleration on platforms that need it. On Rockchip edge devices that depend on the NPU, prioritize the kernel update since module-disable removes the feature; restricting unprivileged container/namespace access to the device node (/dev/accel/accel*) and tightening udev permissions reduces the local attacker surface in the interim. Refer to https://nvd.nist.gov/vuln/detail/CVE-2026-23305 and the git.kernel.org commit links above for backporting.