Linux Kernel CVE-2026-43027

Update to patched kernel versions: 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, or 7.0 and later within each stable branch. Apply distribution-specific kernel security updates from your vendor (Red Hat RHSA, Ubuntu USN, Debian DSA, SUSE updates). Patches are available from upstream stable git repository at https://git.kernel.org/stable/c/5cf28d5c8dcbbe8af6d3b145babe491906d7bad1 and corresponding stable branch commits. If immediate patching is not feasible, implement these compensating controls: (1) Restrict CAP_NET_ADMIN capability using security modules (SELinux, AppArmor) or capability bounding sets to prevent unprivileged users from manipulating netfilter helpers - note this may break container networking tools requiring helper module management; (2) Disable automatic netfilter helper loading via 'sysctl net.netfilter.nf_conntrack_helper=0' and explicitly whitelist required helpers - reduces attack surface but may break FTP/TFTP/SIP connection tracking; (3) Use kernel lockdown mode (integrity or confidentiality) to prevent runtime module loading by non-root - impacts legitimate administrative operations. Standard kernel reboot is required after patching. Verify fix deployment by checking kernel version with 'uname -r' against patched version list.