Linux Kernel CVE-2026-52929

Vendor-released patch: update to a fixed stable kernel - at minimum 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, or 7.0.13 (and 7.1 mainline) - or your distribution's kernel build that incorporates the corresponding backport, then reboot to load it. The specific stable fix commits are published at git.kernel.org (e.g. https://git.kernel.org/stable/c/39dc2b0eb5371a669ebc9ec6072b9184eac95418 and the sibling commits 0cd2dc6d, a6724b7b, 9662eb04, 7dd9a42b, d5ea0b3e, 1c6773b8, a5f8a90a); cross-reference https://nvd.nist.gov/vuln/detail/CVE-2026-52929. Where immediate patching is not possible and SCTP is not required, disable the module by blacklisting it (e.g. 'install sctp /bin/true' in modprobe config, and confirm it is not auto-loaded), which fully removes the attack surface but breaks any SCTP-dependent workload such as SIGTRAN/M3UA telephony or WebRTC data channels. If SCTP must stay enabled, restrict reachability with firewall rules limiting SCTP (IP protocol 132) to known, trusted peers to reduce who can initiate the stream-reconfiguration handshake - at the cost of administrative overhead and potential breakage if peer sets change. These are compensating controls only; applying the kernel update is the durable fix.