Linux Kernel CVE-2026-46205

Vendor-released patch: upgrade to Linux kernel 6.6.140, 6.12.90, 6.18.32, 7.0.9, or 7.1-rc1 (or any later stable release on those branches), referencing the upstream commits at https://git.kernel.org/stable/c/2b7eb2c5dc72f0fc954ac4aa155f9e285e937f7c and the related hashes listed in the NVD references. As a compensating control until patching, blacklist the atomisp kernel module via /etc/modprobe.d/ (e.g., 'blacklist atomisp' with install lines forcing /bin/false) which fully neutralizes the attack surface at the cost of disabling Intel ISP camera functionality on affected hardware; alternatively restrict /dev/video* device node access via udev rules or DAC permissions so only trusted accounts can issue IOCTLs, accepting that legitimate camera-using applications will need their service accounts added to the allowed group. Distribution-shipped kernels rarely build the staging atomisp driver, so most servers and cloud workloads are unaffected without action.