Linux Kernel CVE-2026-43403

Update to patched kernel versions: 6.12.78 for longterm branch, 6.18.20 or 6.19.9 for stable branches, or 7.0+ for mainline. Patches available via git.kernel.org stable tree commits 3376b345df15 (mainline), 2f3dea284c76, 0ad650e60150, and e6b899f08066 (stable branches). Distributions should apply vendor-provided kernel updates incorporating these commits. No reboot-less mitigation exists for this kernel-level issue. Workaround for high-security environments unable to patch immediately: implement mandatory access control policies (SELinux, AppArmor) to deny CAP_SYS_PTRACE and namespace-related capabilities to non-essential privileged services, reducing cross-service inspection surface. This workaround degrades functionality of legitimate debugging and monitoring tools. For containerized workloads, use user namespaces with non-overlapping UID ranges and seccomp filters blocking namespace-related ioctls, though this only partially mitigates the issue as kernel-level services remain vulnerable. Verify patch application by checking kernel version with 'uname -r' matches patched releases.