Linux Kernel CVE-2026-43037

Upgrade to patched kernel versions: 7.0 or later for mainline, 6.19.12+ for 6.19.x branch, 6.18.22+ for 6.18.x, 6.12.81+ for 6.12.x, 6.6.134+ for 6.6.x LTS, 6.1.168+ for 6.1.x LTS, 5.15.203+ for 5.15.x LTS, or 5.10.253+ for 5.10.x LTS. Patches available at https://git.kernel.org/stable/c/2edfa31769a4add828a7e604b21cb82aaaa05925 (mainline) and corresponding stable branch commits. Organizations unable to immediately patch can implement compensating controls: disable IPv6 tunneling modules (ip6_tunnel, sit) if not operationally required using 'modprobe -r ip6_tunnel sit' and blacklisting in /etc/modprobe.d/, though this breaks legitimate IPv6-over-IPv4 functionality. For systems requiring IPv6 tunnels, restrict tunnel endpoint access to trusted networks via iptables/nftables rules blocking IPv6 ICMP packets from untrusted sources, though this may impact legitimate network diagnostics and Path MTU Discovery. Note that disabling IPv6 entirely does not mitigate the issue as the vulnerable code path processes IPv4-in-IPv6 encapsulation. Firewall-based mitigations have limited effectiveness since the vulnerability triggers during ICMP error processing of existing tunnel sessions. Prioritize kernel patching over workarounds given the network-accessible attack surface.