Linux Kernel CVE-2026-43093

Upgrade to patched Linux kernel versions: 7.0 or later for mainline, 6.19.14+ for 6.19.x series, 6.18.24+ for 6.18.x series, 6.12.83+ for 6.12.x LTS, or 6.6.136+ for 6.6.x LTS. Vendor patches available from kernel.org stable repository at the git commit links provided in references. For systems unable to immediately patch, implement the following compensating controls with awareness of trade-offs: (1) Restrict access to AF_XDP socket creation by limiting CAP_NET_RAW and CAP_BPF capabilities to trusted administrative users only (blocks legitimate high-performance networking applications requiring unprivileged AF_XDP access). (2) Disable XDP functionality entirely via kernel boot parameter 'xdp.mode=0' if AF_XDP/XDP features are not required for operational workloads (eliminates zero-copy packet processing capabilities, impacts performance-sensitive network applications). (3) In containerized environments, prevent loading of XDP/eBPF programs through AppArmor, SELinux, or seccomp policies blocking bpf() syscall for untrusted containers (may break legitimate observability tools using eBPF). (4) Monitor for unusual UMEM registration attempts via audit rules tracking XDP socket creation (auditctl -a always,exit -F arch=b64 -S socket -F a0=44). No known workaround fully mitigates without functional impact - patching is strongly recommended for systems exposing AF_XDP to unprivileged users.