Linux Kernel CVE-2026-31496

Vendor-released patch: Upgrade Linux kernel to patched stable versions: 6.1.168 or later (6.1.x series), 6.6.131 or later (6.6.x series), 6.12.80 or later (6.12.x series), 6.18.21 or later (6.18.x series), 6.19.11 or later (6.19.x series), or 7.0 final release or later. If immediate kernel upgrade is not feasible in multi-tenant container deployments, restrict proc filesystem read access via AppArmor or SELinux policies to prevent untrusted processes from reading /proc/net/nf_conntrack_expect; use seccomp rules to block open() syscalls on proc netfilter files for unprivileged workloads. Containers should run with read-only /proc or masked proc mounts (-security-opt apparmor=docker-default or PodSecurityPolicy restrictedProcMount). Trade-off: restrictive proc policies may break container network diagnostics; test thoroughly in staging. Network namespace isolation itself remains intact; this patch simply enforces the isolation at the proc interface level. References: upstream kernel git commits at https://git.kernel.org/stable/ for each fix; verify your distribution's backport via changelog (e.g., Ubuntu security advisories, RHEL errata).