Linux Kernel CVE-2026-31787

Apply vendor-released kernel updates immediately for Xen-enabled systems: upgrade to Linux kernel 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.26, 7.0.3, or later stable releases incorporating the fix commits. Patches are available from kernel.org Git repository (references provided) and distribution-specific security channels. For systems unable to apply kernel updates immediately, disable the Xen privcmd driver by unloading the xen-privcmd kernel module (modprobe -r xen_privcmd) if not actively required for domain management, though this will break Xen toolstack functionality including xl/xm domain creation and management operations. Alternatively, restrict access to /dev/xen/privcmd device node to only trusted privileged users via filesystem permissions (chmod 600 /dev/xen/privcmd), recognizing this provides defense-in-depth but does not eliminate the vulnerability if those users are compromised. For production Xen environments, kernel patching is the only complete remediation-compensating controls merely reduce attack surface. Verify patch application by checking kernel version (uname -r) matches patched releases and reviewing git commit logs for presence of .may_split callback additions to privcmd_vm_ops structure. See official advisories at openwall.com/lists/oss-security/2026/04/28/14 and xenbits.xen.org/xsa/advisory-487.html for additional vendor guidance.