Linux Kernel CVE-2026-43373

Upgrade to patched kernel versions: 5.10.253 or later for 5.10.x LTS branch, 5.15.203+ for 5.15.x, 6.1.167+ for 6.1.x, 6.6.130+ for 6.6.x, 6.12.78+ for 6.12.x, 6.18.19+ for 6.18.x, 6.19.9+ for 6.19.x, or 7.0+ for mainline. Distribution-specific patches: apply security updates from RHEL, Ubuntu, SLES, Debian security repositories that backport the fixes (commits b70c4e5e7119, 553366c27147, 59962588197, 5c3398a54266, 81d6aee32f8f, fef5aa6e3bcf, 87138dde2d69, 9891d7f4f1ed). If immediate patching is not feasible, disable NCSI protocol handling by blacklisting the ncsi kernel module (echo 'blacklist ncsi' >> /etc/modprobe.d/blacklist.conf && update-initramfs -u), though this breaks BMC-based out-of-band management functionality. Alternatively, restrict NCSI network access via firewall rules to trusted management networks only, preventing external attackers from sending malformed packets - effectiveness depends on network segmentation as NCSI operates at layer 2/3 boundary. Monitor kernel memory allocation rates (sar -r, /proc/meminfo) for unusual skb_head_cache growth indicating active exploitation. Compensating controls trade BMC management capabilities for risk reduction; assess operational impact before deployment.