Linux kernel CVE-2026-43500

Apply vendor-released patches immediately for affected kernel branches: upgrade to Linux kernel 6.18.29 or later for 6.x stable series, 7.0.6 or later for 7.0 stable series, or 7.1-rc3 or later for development kernels. Upstream fixes available at https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71, https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411, and https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c. The fix extends the skb unsharing gate to check skb_has_frag_list() and skb_has_shared_frag() in addition to skb_cloned(), ensuring externally-owned fragments are copied to linear buffers before cryptographic operations. If immediate patching is not feasible, compensating controls include disabling the rxrpc kernel module via blacklist (add 'blacklist rxrpc' to /etc/modprobe.d/blacklist.conf and rebuild initramfs), which prevents exploitation but breaks AFS and other rxrpc-dependent functionality-acceptable only if these services are not required. Alternatively, restrict local user access through mandatory access controls (SELinux/AppArmor) to limit potential attackers to non-interactive service accounts, though this only reduces attack surface rather than eliminating the vulnerability. For environments requiring rxrpc functionality, prioritize kernel updates as no effective workaround exists that maintains full service availability. Verify patch application by checking kernel version with 'uname -r' and confirming commit presence in kernel source.