Linux Kernel CVE-2026-31675

Apply the vendor-released patch by upgrading to a fixed kernel: 6.6.134, 6.12.81, 6.18.22, 6.19.12, or 7.0 (mainline), whichever matches your stable series, per the git.kernel.org stable commits (a14b56863348, 13a66ca1e235, 3a2999704ac3, 4fd258e281fa, d64cb81dcbd5). Distribution users should track and apply Ubuntu USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1) or the equivalent advisory for their distro. Where immediate patching is not possible, the practical compensating control is to avoid configuring netem qdiscs with the 'corrupt' option on production hosts (e.g., do not use 'tc qdisc ... netem corrupt <pct>'), since the vulnerable branch only runs when corruption is enabled - the side effect is loss of that specific traffic-emulation capability, which is normally only used in test/lab environments. Additionally, restrict CAP_NET_ADMIN and disable unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0 where supported) to prevent untrusted users from creating the required qdisc configuration; the trade-off is that this can break container runtimes and sandboxes that legitimately rely on user namespaces. The fixed code simply skips corruption for fully non-linear packets, so patching has no functional downside.