Linux Kernel CVE-2026-46093

Apply the vendor-released patches by upgrading to Linux kernel 6.18.27, 7.0.4, or 7.1-rc1 (or any later release that includes the upstream commits ec05f51f, 12f2341b, and 687ccdf5 referenced at https://git.kernel.org/stable/c/ec05f51f1e65bce95528543eb73fda56fd201d94, https://git.kernel.org/stable/c/12f2341b4c235d5593a433abac201c1c6725787f, and https://git.kernel.org/stable/c/687ccdf582169cd680aeaf24cc953807c4cd4345) and reboot, since this is a non-livepatchable core mm change on most distros. There is no clean userspace workaround because the vmap shrinker is driven by global memory pressure; partial mitigations are to reduce attacker ability to influence shrinker timing by limiting untrusted local code execution (restrict shell access, unprivileged containers, and unprivileged user namespaces) and to lower memory pressure on exposed hosts (raise vm.min_free_kbytes, avoid running at near-OOM), accepting the trade-off of reduced memory utilization and tighter access policies. Pending reboot, monitor dmesg for vmalloc list-corruption or BUG warnings as a detection proxy.