Linux Kernel CVE-2026-52920

Apply the vendor-released patch by upgrading to a fixed stable kernel: 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (or later within each series), matching your distribution's backport. The corresponding upstream commits are published at git.kernel.org (e.g. https://git.kernel.org/stable/c/eb323f7b82d2e2f638de0cc2a177803eb20e0707 and the sibling stable commits), and the issue is catalogued at https://nvd.nist.gov/vuln/detail/CVE-2026-52920. If immediate patching is not possible, audit your firewall rules and avoid relying on xt_policy strict mode with multiple policy elements for inbound matching; rewrite affected rules as single-element matches or enforce the equivalent constraint with separate sequential rules/XFRM policy, accepting that this is more verbose and harder to maintain. As defense in depth, do not treat the xt_policy match as the sole IPsec-enforcement boundary while unpatched, and validate that inbound IPsec-protected flows are still accepted to avoid accidentally dropping legitimate traffic.