Linux Kernel CVE-2026-43287

Update the Linux kernel to a patched version: 5.10.252+, 5.15.202+, 6.1.165+, 6.6.128+, 6.12.75+, 6.18.16+, 6.19.6+, or mainline 7.0+. Patches are available from kernel.org stable branches and distribution vendors. If immediate patching is not feasible, implement compensating controls: (1) Restrict access to /dev/dri/card* and /dev/dri/renderD* devices using udev rules or container securityContext to limit which users/containers can invoke DRM ioctls-this prevents unprivileged users from triggering the vulnerability but breaks GPU acceleration for restricted processes; (2) Configure strict memory cgroup limits (memory.max in cgroup v2 or memory.limit_in_bytes in cgroup v1) for untrusted workloads to contain kernel memory exhaustion impact, though this does not prevent the unaccounted allocations and may still allow localized DoS; (3) Monitor kernel memory usage (slabtop, /proc/slabinfo for drm_property_blob) and alert on anomalous growth. Trade-offs: DRM access restriction breaks legitimate GPU workloads; cgroup limits mitigate blast radius but do not fix the root cause; monitoring provides detection but no prevention. Full remediation requires kernel upgrade. Refer to git.kernel.org commits listed in affected_products for detailed patch content.