Linux Kernel CVE-2026-43426

Apply the vendor-released patch by upgrading to a fixed stable kernel: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9, or mainline 7.0 or later, depending on which stable branch you track. The upstream fix commits are available at https://git.kernel.org/stable/c/c7012fc73dab4829404fedeeaa8531f12ac8545f and the related stable backports listed in the references. If patching is not immediately feasible on embedded Renesas hardware where kernel updates are gated by the SoC vendor BSP, compensating controls are limited: blacklist the renesas_usbhs module via /etc/modprobe.d if the controller is not required (trade-off: disables USB on that interface entirely), restrict USB device bind/unbind operations to root by tightening udev rules and removing user write access to /sys/bus/usb/drivers/*/unbind (trade-off: may break hot-plug workflows), and limit physical access to USB ports to reduce attacker-induced removal events.