Linux Kernel CVE-2026-43503

Vendor-released patches are available across all maintained stable branches - upgrade to Linux 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or mainline 7.1-rc5 (or any later release on the same series), or apply the corresponding stable commits listed at git.kernel.org/stable (e.g., 3599e6b3cc1a, 2f2b16022a2e, 9d3e5fd19fe1, 78bf6b6bb195, 760e1addc27b, 3bd9e113d500, 3884358a9286, fbeab9555564, 179f1852bdedc, 12401fcfb01f, 989214c66884, fc6eb39c55e9, ff375cc75f91, 9bc9d6d6967a). Distribution users should track their vendor's CVE-2026-43503 advisory and install the matching kernel package; reboot is required for kernel updates unless livepatch coverage is offered by the distribution. As a compensating control until patching, sites that do not require IPsec on receiving hosts can unload or disable the esp4/esp6 modules (modprobe -r esp4 esp6) which removes the vulnerable in-place decryption path at the cost of breaking any tunneled or transport-mode IPsec traffic; sites that do require IPsec can reduce exposure by avoiding sendfile/MSG_ZEROCOPY producers on the same hosts, though this is a partial mitigation and may regress throughput for file-serving workloads.