Linux Kernel CVE-2026-31413

Upgrade to patched Linux kernel versions: 6.12.80 or later for 6.12.x series, 6.18.21 or later for 6.18.x series, 6.19.11 or later for 6.19.x series, or 7.0-rc5 and later for development branch. The upstream fix is implemented in commits d13281ae7ea8902b21d99d10a2c8caf0bdec0455 (mainline), 342aa1ee995ef5bbf876096dc3a5e51218d76fa4, 58bd87d0e69204dbd739e4387a1edb0c4b1644e7, and c845894ebd6fb43226b3118d6b017942550910c5 (stable branches), available at https://git.kernel.org/stable/. The fix modifies maybe_fork_scalars() to pass env->insn_idx instead of env->insn_idx + 1 to push_stack(), forcing the pushed verifier path to re-execute the ALU instruction with the forked register state and naturally compute the correct result. For systems unable to immediately patch, disable unprivileged BPF program loading via sysctl kernel.unprivileged_bpf_disabled=1 (prevents non-root users from loading BPF programs, eliminating local attack vector but breaks legitimate unprivileged BPF use cases like unprivileged container monitoring). Alternatively, disable BPF entirely if not required via kernel boot parameter bpf.jit_enable=0 or CONFIG_BPF_SYSCALL=n at compile time (breaks all BPF-dependent functionality including networking filters, tracing, and security monitoring tools). Restrict local user access and monitor for suspicious BPF syscall activity via audit rules.