Linux Kernel CVE-2026-43024

Apply vendor-released kernel patches: upgrade to Linux 5.10.253, 5.15.203, 5.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, or 7.0 (or later stable releases in each branch). Patch commits are available at git.kernel.org/stable - administrators should apply the fix specific to their running kernel version. For systems unable to immediately reboot, the short-term compensating control is to restrict nftables rule creation via file permissions or AppArmor/SELinux policies - specifically, revoke CAP_NET_ADMIN from non-essential processes and limit which users can invoke nftables rules or modify /etc/nftables.conf rules. However, this control is incomplete if system administrators are already trusted; full remediation requires kernel patching. No workaround exists for trusted local users with legitimate need for nftables administration. Verify patching post-reboot by checking kernel version (uname -r) and confirming commit hash presence (git log in kernel source tree) if building custom kernels.