Linux CVE-2026-23395

Upgrade to patched Linux kernel versions: 6.1.167+ for LTS users, 6.6.130+ for 6.6.x branch, 6.12.78+ for 6.12.x branch, 6.18.20+ for 6.18.x branch, 6.19.10+ for 6.19.x branch, or 7.0-rc5+ for mainline. Kernel.org stable tree commits available at https://git.kernel.org/stable/c/8d0d94f8ba5b3a0beec3b0da558b9bea48018117 and related branch-specific commits listed in references. Distribution-specific updates: Debian users should apply security updates through apt when available for their tracked releases. If immediate patching is not feasible, disable Bluetooth subsystem entirely via kernel boot parameter 'bluetooth.disable_ertm=1' or by blacklisting bluetooth kernel module (add 'blacklist bluetooth' to /etc/modprobe.d/blacklist.conf and rebuild initramfs). Note this breaks all Bluetooth functionality including input devices, audio, and file transfer. For systems requiring Bluetooth, implement network segmentation to isolate Bluetooth-enabled hosts from untrusted physical spaces, disable Bluetooth discoverability/pairing modes when not actively needed, and apply MAC-based filtering to allow only known device addresses. These mitigations reduce but do not eliminate risk as the flaw exists in connection request handling before pairing authentication. Compensating controls carry operational impact: disabling Bluetooth may break legitimate device workflows, MAC filtering creates management overhead and is bypassable via address spoofing. Vendor advisories: Linux kernel stable tree releases and EUVD-2026-15398 provide authoritative patch information.