Linux Kernel CVE-2026-43284

Upgrade to patched Linux kernel versions: 6.6.138+ for 6.6.x series, 6.12.87+ for 6.12.x series, 6.18.28+ for 6.18.x series, or 7.0.5+ for 7.0.x series. Patches are available from kernel.org stable trees and distribution-specific repositories (references include kernel.org stable commit links and oss-security mailing list announcement at openwall.com/lists/oss-security/2026/05/08/7). If immediate patching is not feasible, consider these compensating controls with trade-offs: (1) Disable ESP-in-UDP encapsulation if not required for NAT traversal - edit /etc/ipsec.conf or strongSwan configuration to remove 'encap=yes' directives, preventing vulnerable code path but breaking IPsec through NAT devices. (2) Restrict splice() syscall usage via seccomp-bpf filters in containers/sandboxes running untrusted code - adds syscall filtering overhead and requires application compatibility testing. (3) Limit local user access and enforce principle of least privilege - reduces attack surface but does not eliminate risk from compromised low-privilege accounts. Distributions typically backport fixes to their supported kernel versions, so consult distribution-specific security advisories for RHEL, Ubuntu, Debian, SLES kernel packages. Verify patch application by checking kernel version with 'uname -r' and confirming fix commits are present in your kernel source tree.