Linux Kernel CVE-2026-43025

Upgrade to patched Linux kernel versions: 6.1.168+ for the 6.1.x LTS branch, 6.6.134+ for 6.6.x LTS, 6.12.81+ for 6.12.x stable, 6.18.22+ for 6.18.x stable, 6.19.12+ for 6.19.x stable, or 7.0+ for mainline kernels. Upstream fix commits are available at https://git.kernel.org/stable/c/917b61fa2042f11e2af4c428e43f08199586633a (mainline) and corresponding stable branch commits (187b6ec5229e, 21a04c31db40, 2ea0f35f235f, 0f6c33697ccf, e135f8e8212c). The patch modifies ctnetlink_create_expect to ignore userspace-supplied helper names for new expectations and always use the master conntrack's helper, simplifying validation and preventing the out-of-bounds read. If immediate kernel upgrade is not feasible, restrict CAP_NET_ADMIN capability to only highly trusted administrative accounts, though this is standard practice and provides limited additional protection since the capability is already privileged. As a compensating control, disable the nf_conntrack_netlink module (rmmod nf_conntrack_netlink) if userspace conntrack manipulation is not required, though this will break tools like conntrack-tools and certain firewall management utilities that depend on netlink-based connection tracking control. Monitor for abnormal netlink socket activity from unprivileged or semi-privileged users, though detection may be difficult given legitimate administrative use cases.