Linux Kernel CVE-2026-31700

Primary remediation is upgrading to patched kernel versions: 6.6.136 or later for 6.6.x LTS series, 6.12.84 or later for 6.12.x series, 7.0.2 or later for 7.0.x series, or 7.1-rc1 and later for mainline. Distribution-specific kernel packages should be updated via normal security update channels (apt, yum, dnf) once vendors backport the fix. Patch commits are available at https://git.kernel.org/stable/c/28324a3b62d9ce7f9bdd65a8ce63f382041d1b27 (and related commits) for manual backporting if necessary. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: (1) Restrict CAP_NET_RAW capability to only essential processes via capability bounding sets or AppArmor/SELinux policies - this prevents unprivileged users from creating AF_PACKET sockets but may break legitimate packet capture tools like tcpdump for non-root users; (2) Disable unprivileged user namespaces via sysctl kernel.unprivileged_userns_clone=0 to prevent privilege escalation paths, though this breaks containerized workloads for non-root users; (3) In virtualized environments, avoid using vhost-net with PACKET_VNET_HDR offload where possible, favoring alternative virtio configurations, though this may reduce network performance by 10-30%. Monitor for unexpected AF_PACKET socket creation via auditd rules (auditctl -a always,exit -F arch=b64 -S socket -F a0=17). Note that workarounds only reduce attack surface and do not eliminate the race condition for privileged processes that legitimately use TPACKET.