Linux Kernel CVE-2026-46168

The primary remediation is to upgrade to a patched kernel version. Upgrade to Linux 6.6.140 or later on the 6.6.x LTS branch, 6.12.88 or later on the 6.12.x branch, 6.18.30 or later on the 6.18.x branch, or 7.0.7 or later on the 7.0.x branch. Development systems tracking mainline should use 7.1-rc2 or a post-fix mainline commit. Patches are publicly available at the kernel.org stable git repository (https://git.kernel.org/stable/c/7eb513b42721bee4b96da69f6188d5a7783f210d and related commits listed in references). Downstream distributors (Debian, Ubuntu, RHEL, SUSE, etc.) are expected to backport these fixes into their respective kernel packages - check the relevant distribution's security tracker for package availability. If an immediate kernel upgrade is not feasible and the deployment involves untrusted local users, a viable compensating control is to restrict MPTCP socket creation by loading a seccomp policy or using LSM rules (SELinux/AppArmor) that block setsockopt calls with SO_TIMESTAMP/SO_TIMESTAMPING on MPTCP sockets for non-privileged users; however, this may impact legitimate network monitoring applications that rely on kernel timestamping. Disabling MPTCP entirely via 'sysctl net.mptcp.enabled=0' eliminates the attack surface entirely if MPTCP is not operationally required, with the trade-off of losing multipath TCP functionality.