Linux CVE-2026-23391

Upgrade to patched kernel versions: 6.1.167 or later for 6.1.x series, 6.6.130+ for 6.6.x, 6.12.78+ for 6.12.x, 6.18.20+ for 6.18.x, 6.19.10+ for 6.19.x, or 7.0-rc5+ for mainline. Upstream patches available at git.kernel.org stable commits 777d02efe3d6 (mainline), d2d0bae0c9a2 (stable), 63b8097cea19, 19a230dec6bb, cb549925875f, and f62a218a946b. If immediate patching is infeasible, implement compensating controls: disable loading of netfilter helper modules (echo 0 > /proc/sys/net/netfilter/nf_conntrack_helper, add nf_conntrack_helper=0 to kernel boot parameters) to prevent helper-based exploitation vector - this breaks applications relying on connection tracking helpers like active FTP, SIP, or TFTP. Restrict CAP_NET_ADMIN capability to trusted users only via capability bounding sets or LSM policies to prevent untrusted users from manipulating connection tracking rules. Audit existing iptables/nftables rules for CT target usage with --helper or --timeout options and remove if not operationally required. Note that disabling helpers may break legitimate application functionality requiring stateful inspection of complex protocols. For production environments, test helper disablement in staging before deployment.