Linux Kernel CVE-2026-31708

Primary remediation is upgrading to patched kernel versions: 6.6.136 or later for the 6.6.x series, 6.12.84 or later for 6.12.x, 6.18.25 or later for 6.18.x, 7.0.2 or later for 7.0.x, or 7.1-rc1 and beyond. Patches are available from the stable kernel git repository at https://git.kernel.org/stable/c/078fae8f50adebb903ccf2252b44391324571e78 and related commits listed in references. Organizations unable to patch immediately should implement compensating controls: restrict SMB client connections to explicitly trusted servers only via firewall rules (blocks opportunistic attacker-controlled servers but may disrupt legitimate workflows requiring dynamic SMB access); disable the CIFS/SMB kernel module entirely if not required (effective but breaks all SMB functionality); or deploy network monitoring to detect anomalous SMB QUERY_INFO responses with oversized OutputBufferLength fields (requires deep packet inspection and SMB protocol expertise, limited effectiveness against encrypted SMB3). The most practical interim mitigation is user education to avoid mounting untrusted SMB shares combined with network segmentation to prevent connections to attacker-controlled infrastructure. Note that disabling SMBv2/v3 in favor of SMBv1 is not a viable mitigation and introduces worse security risks.