Linux Kernel CVE-2026-46199

Upstream fix available (commits 63b51e8a9d54, 0a78f2bac142, 7688143ca62e, c72a8b4dc6d5, 3c817a60b09e) and released in stable kernels 6.6.140, 6.12.90, 6.18.32, 7.0.9, and mainline 7.1-rc1 - upgrade to one of these patched versions or to the equivalent distribution-vendor kernel that backports the amdgpu/vcn4 bounds check; the patches are linked from https://git.kernel.org/stable/c/63b51e8a9d54317d31cc3856c1e12407070d5fc2 and the other commit references in the NVD advisory. As a compensating control until patched, restrict local DRM render-node access (/dev/dri/renderD*) to trusted users via group permissions or systemd seat assignments, disable hardware-accelerated video decode in containerized or multi-tenant workloads that expose VCN4 to untrusted users, and avoid sharing the GPU device into untrusted VMs or sandboxes; these mitigations come at the cost of losing hardware video decode acceleration for the affected workloads and may break browser GPU sandboxes, Wayland compositors, or media playback for non-privileged users.