Linux Kernel CVE-2026-43060

Upgrade to patched kernel versions: 5.10.253 or later for 5.10.x branch, 5.15.203+ for 5.15.x, 6.1.167+ for 6.1.x LTS, 6.6.130+ for 6.6.x LTS, 6.12.78+ for 6.12.x, 6.18.20+ for 6.18.x, 6.19.10+ for 6.19.x, or kernel 7.0 for mainline. Patch commits available at https://git.kernel.org/stable/ with identifiers ab50302190b3, 36eae0956f65, e68a8db3a054, 3da0b946835f, f29a055e4f59, 77da55dee677, 8a64e7693367, and 6802ff8beceb. For systems unable to immediately patch, implement compensating controls: disable nfqueue functionality if not required by removing nfnetlink_queue module (modprobe -r nfnetlink_queue) which prevents packet queueing to userspace - trade-off is loss of userspace packet filtering capabilities. Restrict nftables configuration changes to root-only by ensuring unprivileged users cannot modify /etc/nftables.conf or execute nft commands, limiting attack surface to already-privileged accounts. Avoid dynamic module unloading in production by setting kernel.modules_disabled=1 sysctl after boot, though this prevents all module operations until reboot. Monitor for unusual nftables rule modifications or nfqueue usage via auditd rules targeting nft command execution and netlink socket activity.