Linux Kernel CVE-2026-43117

Upgrade to patched Linux kernel versions: 6.6.136 or later for 6.6.x branch, 6.12.83 or later for 6.12.x branch, 6.18.24 or later for 6.18.x branch, 6.19.14 or later for 6.19.x branch, or 7.0 or later for mainline. Upstream patch commits are available at https://git.kernel.org/stable/c/d110d7cdb045715c0b45b0dfd974525bb38f653d (and related commits listed in references). For systems unable to upgrade immediately, implement these compensating controls with noted trade-offs: (1) Avoid mounting OverlayFS on btrfs filesystems - use ext4 or xfs as the lower layer for OverlayFS instead (trade-off: lose btrfs snapshot/subvolume features for container storage); (2) Disable btrfs tracepoints if kernel tracing is not operationally required - check /sys/kernel/debug/tracing/events/btrfs/ and disable via echo 0 to enable files (trade-off: lose btrfs performance monitoring and debugging capability); (3) If using containers, configure container runtime to use a different storage driver that doesn't rely on OverlayFS-on-btrfs combination (trade-off: may require rebuilding container images and storage migration). Monitor kernel logs for btrfs-related crashes or panics during fsync operations as indicators of exploitation attempts. Consult your Linux distribution's security advisories for distribution-specific patch availability and backport timelines.