Linux CVE-2026-23372

Upgrade to patched Linux kernel versions: 6.1.167 or later for 6.1 LTS branch, 6.6.130+ for 6.6 stable, 6.12.77+ for 6.12 stable, 6.18.17+ for 6.18 stable, 6.19.7+ for 6.19 stable, or 7.0-rc3+ for mainline development. Distribution-specific updates should be applied through normal package management (apt/yum/dnf) as vendors backport fixes to supported kernel versions. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: (1) Blacklist NFC kernel modules (nfc.ko, nci.ko) via /etc/modprobe.d/ configuration to prevent module loading - eliminates NFC functionality entirely but removes attack surface on systems not requiring NFC; (2) Restrict access to /dev/nfc* device nodes and NFC socket creation using AppArmor/SELinux policies or group-based permissions - reduces attack surface to explicitly authorized users but requires policy customization and may break legitimate NFC applications; (3) Disable NFC subsystem at boot via kernel command line parameter (nfc.disable=1 if available) - OS-level mitigation but requires bootloader reconfiguration and reboot. Workarounds reduce but do not eliminate risk as race conditions may still trigger under specific timing conditions. Patching remains the definitive remediation. Verify patch application by checking kernel version with 'uname -r' and confirming commit presence with 'git log' on kernel source or reviewing distribution security advisories.