Linux Kernel CVE-2026-46220

Upgrade to a patched kernel version: 6.6.140 or later for the 6.6.x stable branch, 6.12.90 or later for 6.12.x, 6.18.32 or later for 6.18.x, 7.0.9 or later for 7.0.x, or 7.1-rc3 or later for mainline. Patch is available from the Linux kernel stable team via git.kernel.org (see fix commits above). The upstream cherry-pick commit is b90250bd933afd1ba94d86d6b13821997b22b18e. For systems that cannot be patched immediately, compensating controls include restricting access to the AMD GPU DRM render nodes (/dev/dri/renderD*) to trusted users only via group permissions (e.g., the 'render' or 'video' group), which prevents unprivileged users from submitting CS ioctls; trade-off is that GPU-accelerated applications for non-privileged users will break. Alternatively, if AMD GPU compute access is not required for interactive users, blocking access to the DRM device entirely via udev rules is effective. Removing untrusted local users from systems with SDMA v4 GPUs is the most conservative compensating control but has obvious operational impact. Distribution-specific kernel updates (RHEL, Ubuntu, SUSE, Debian) should be monitored for backported fixes if the above upstream versions do not match the installed kernel series.