Linux Kernel CVE-2026-31525

Upgrade to patched Linux kernel versions: 6.6.131 or later for the 6.6 LTS branch, 6.12.80+ for 6.12 stable, 6.18.21+ for 6.18 stable, or 6.19.11+ for 6.19 stable. Mainline users should apply commit 694ea55f1b1c74f9942d91ec366ae9e822422e42 or use kernel 7.0+. Distribution users should apply vendor-provided kernel updates through normal package management (apt upgrade linux-image-* / yum update kernel / dnf upgrade kernel). Verify patch application by checking kernel git log for abs_s32() introduction or reviewing /proc/version against patched version numbers. If immediate patching is not feasible, disable unprivileged BPF program loading as a highly effective compensating control: set kernel.unprivileged_bpf_disabled=1 via sysctl (sysctl -w kernel.unprivileged_bpf_disabled=1 and persist in /etc/sysctl.d/99-bpf-hardening.conf). Note that this mitigation only protects against unprivileged exploitation; root or CAP_BPF-capable processes can still trigger the vulnerability, so it should be considered a temporary measure. Disabling unprivileged BPF may break applications that rely on it (certain observability tools, legacy packet filters), though modern tooling using BPF CO-RE typically runs privileged. Monitor audit logs for BPF syscall usage (auditctl -a always,exit -F arch=b64 -S bpf) to detect potential exploitation attempts. Full remediation requires kernel patching.