Linux Kernel CVE-2026-45932

Vendor-released patch: upgrade to Linux kernel 6.18.14, 6.19.4, or any later stable release that includes commits ae23bc81ddf7c17b663c4ed1b21e35527b0a7131, 4e0772cded109c238411f2fac36ac39302758b81, or 3f04cc1e5374da4c5e791ae010a06cfea7bacbe6 (see https://git.kernel.org/stable/c/ae23bc81ddf7c17b663c4ed1b21e35527b0a7131, https://git.kernel.org/stable/c/4e0772cded109c238411f2fac36ac39302758b81, and https://git.kernel.org/stable/c/3f04cc1e5374da4c5e791ae010a06cfea7bacbe6), and rebuild downstream distribution kernels accordingly. Where immediate kernel upgrade is not feasible, restrict the bpf() syscall on multi-tenant systems by enabling kernel.unprivileged_bpf_disabled=1 via sysctl (this prevents unprivileged BPF use broadly and may break workloads that rely on user-mode BPF such as some observability agents), or apply a seccomp filter at the container/sandbox layer to block BPF_PROG_DETACH for untrusted processes (which requires per-workload tuning and may interfere with legitimate program lifecycle management). On container hosts, ensuring containers do not receive CAP_BPF and run under user namespaces without host-network privileges further reduces exposure at the cost of constraining networking-oriented workloads.