Linux Kernel CVE-2026-43494

Upstream fix available as commit e174929793195e0cd6a4adb0cad731b39f9019b4 in the 7.1-rc4 series; apply the corresponding stable-tree backport for your kernel branch (see https://git.kernel.org/stable/c/0bbbff00a15b1df2cac9014d6cf4b6890f473353 and the sibling commits 290e833d1acb1093bc121fcdc97f5e6161157479, 640e37f58f991546a87540d067279c2c1fa9fe51, 9115669faedccdda100428e2d26fd0aac8c50799). Distribution-shipped kernels should be updated as soon as vendor packages land - track the OSS-security thread at http://www.openwall.com/lists/oss-security/2026/05/21/2 for advisory coordination. As a compensating control where patching must be deferred, blacklist the rds and rds_tcp modules via /etc/modprobe.d (install rds /bin/true) which eliminates the affected code path entirely at the cost of breaking any application that depends on AF_RDS sockets - uncommon outside Oracle DB / InfiniBand HPC deployments. Where module removal is not viable, restricting CAP_NET_RAW via seccomp or dropping it from container/service profiles raises the bar for local exploitation, though it does not close the bug for processes that legitimately hold the capability.