Linux Kernel CVE-2026-46206

Vendor-released patch: upgrade to Linux 6.6.140, 6.12.90, 6.18.32, 7.0.9, or 7.1-rc4 (or any later stable release in those series) which contain the fix that rejects new tp_meter sessions once mesh_state is no longer BATADV_MESH_ACTIVE. Distribution users should track their vendor's kernel updates (Debian, Ubuntu, RHEL, SUSE) that backport these stable commits. As a compensating control if patching is delayed, unload or blacklist the batman_adv kernel module on systems that do not use mesh networking (modprobe -r batman_adv; add to /etc/modprobe.d/blacklist), which fully eliminates the attack surface but breaks any batman-adv mesh functionality; alternatively, restrict CAP_NET_ADMIN and disable user access to the batctl tp_meter command on multi-user systems to remove the trigger path, at the cost of losing throughput measurement capability for legitimate operators. Patch commits are at git.kernel.org/stable/c/ff93f86ecbb50a4709c403fc279a396e308edde5 and its backports.