Linux Kernel CVE-2026-46212

Apply the vendor-released patch by upgrading to a fixed Linux kernel: 6.6.140, 6.12.90, 6.18.32, 7.0.9, or 7.1-rc4 or later, using the stable-tree commits 00155f336a5e, 0cc9847c64cb, 368449e467d5, 4ae1709a3140, or 6c5dc6d68e6b at git.kernel.org/stable. For systems that cannot be rebooted immediately, the most effective compensating control is to unload or blacklist the batman-adv kernel module (modprobe -r batman_adv; add 'blacklist batman-adv' to /etc/modprobe.d/) on hosts that do not participate in a mesh - this fully removes the attack surface but breaks any mesh networking that depends on it. For hosts that must run batman-adv, restrict physical/L2 access to the mesh segment and avoid bridging untrusted networks into batadv interfaces, since the AV:A vector requires the attacker to be on the same broadcast domain; this does not eliminate risk but reduces exposure to known peers. Monitor dmesg for KASAN UAF reports on batadv_claim_release as an indicator of exploitation attempts on debug kernels.