Linux Kernel CVE-2026-43248

Upgrade to patched Linux kernel versions: 6.12.75+ for 6.12.x series, 6.18.16+ for 6.18.x series, 6.19.6+ for 6.19.x series, or 7.0+ for mainline. Vendor patches consolidate ASID group bounds checking in vhost_vdpa core (commits linked at https://git.kernel.org/stable/c/ddb57354634b6ba851b79da45f1de42c646f27d0 and related stable branches). If immediate patching is not feasible, disable vDPA device support by blacklisting vhost_vdpa and vdpa_sim kernel modules (modprobe.d blacklist), though this eliminates hardware-accelerated virtio functionality for VMs and may degrade performance in virtualization workloads. For high-security environments, restrict access to /dev/vhost-vdpa* device nodes using udev rules to trusted virtualization management processes only, reducing local attacker surface. Compensating controls trade virtualization performance (vDPA disablement) or operational flexibility (device access restrictions) for security. Patching remains the only complete remediation without functional trade-offs.