Linux Kernel CVE-2026-46301

Vendor-released patch: update to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.88, 7.0.7, or 6.18.30 (or later on each branch), or mainline 7.1-rc1, applying the branch that matches your deployment; distro users should install the corresponding patched kernel package from their vendor. The fix commits are available at git.kernel.org (see the stable hashes above) for backporting if you maintain a custom kernel. As a compensating control where immediate patching is not possible, restrict who can unbind drivers by ensuring only root/privileged users can write to the driver's sysfs bind/unbind interface (default on hardened systems) and avoid automated hotplug/unbind flows for this device; on systems that do not use Intel EG20T/OKI ML7213 SPI hardware, blacklist the module (blacklist spi-topcliff-pch / prevent pch_spi from loading), which removes the attack surface entirely with no functional trade-off since the driver only serves that legacy controller.