Linux Kernel CVE-2026-31436

Upgrade to patched kernel versions: 6.12.80 or later in the 6.12 LTS series, 6.18.21 or later in 6.18 stable, 6.19.11 or later in 6.19 stable, or 7.0 mainline. Patches are one-line fixes replacing descriptor completion of 'found' with 'd' in llist_abort_desc(), viewable at commit 0e4f43779d550e559be13a5cdb763bad92c4cc99 and parallel stable branches. For systems unable to patch immediately, compensating controls include: unloading the idxd module ('rmmod idxd') if Intel DSA hardware is not business-critical (side effect: disables hardware-accelerated data movement for applications using DSA); restricting /dev/dsa* device access to root only via udev rules (limits attack surface to privileged users but does not prevent kernel bugs if root or kernel modules trigger the path); monitoring for kernel panics or memory corruption signatures in logs. Disabling the driver eliminates risk but impacts performance for workloads depending on DMA acceleration. No workaround prevents the bug if the driver remains active.