Linux Kernel CVE-2026-43452

Update to patched Linux kernel versions: 5.10.253 or later for 5.10.x series, 5.15.203+ for 5.15.x, 6.1.167+ for 6.1.x, 6.6.130+ for 6.6.x, 6.12.78+ for 6.12.x, 6.18.19+ for 6.18.x, 6.19.9+ for 6.19.x, or mainline 7.0+. Consult distribution-specific security advisories for vendor-supported kernel updates (RHEL, Ubuntu, Debian, SUSE kernels receive backported fixes independently). For systems unable to immediately patch, implement network-layer compensating controls: restrict netfilter rule sets to avoid TCP/UDP/DCCP option matching on untrusted traffic sources using iptables/nftables rules without '--tcp-option', '--udp-option', or DCCP equivalents, though this eliminates legitimate use cases for option-based filtering and may break application-layer protocols requiring option inspection. Alternatively, deploy network segmentation to prevent untrusted internet traffic from reaching vulnerable kernel packet processing paths, accepting reduced defense-in-depth for perimeter systems. These workarounds provide incomplete protection and carry operational trade-offs including reduced security policy granularity and potential application compatibility issues. Kernel patching remains the only complete remediation. Verify patch application with 'uname -r' output matching fixed version numbers and validate netfilter functionality post-update. Full references at https://git.kernel.org/stable/c/c2a445367a496a3c25dbc940c10c8bd1cfd4c14a and related commit links.