Linux Kernel CVE-2026-52936

The definitive fix is to upgrade to a patched kernel release: 6.6.141 or later on the 6.6 LTS branch, 6.12.91 or later on the 6.12 LTS branch, 6.18.33 or later on the 6.18 branch, 7.0.10 or later on the 7.0 branch, or any 7.1+ mainline build. Upstream patch commits are available at https://git.kernel.org/stable/c/18216b8ab6904753eaf31baf453cb02ecd202ba4 (6.6), https://git.kernel.org/stable/c/ff734dbd9e2432601a6dcd167cfb0bf8a36d1880 (6.12), https://git.kernel.org/stable/c/01d798e9feb30212952d4e992801ba6bd6a82351 (6.18), and https://git.kernel.org/stable/c/ec427dc5286da1ed08f2d510e2147a7581b0cb02 (7.0). For environments where immediate kernel patching is not possible, a compensating control is to route entropy demand through a hardware RNG by configuring /sys/kernel/trng_source (where supported) to prefer hwrng over the software jitterentropy path, which bypasses the affected spinlock under load; note this requires hardware RNG support and may not be available in all VM or container environments. Alternatively, reducing the number of concurrent processes that call getrandom() simultaneously via cgroup CPU or process limits can reduce spinlock contention, though this may introduce application-level latency in cryptographic workloads and does not eliminate the vulnerability. Kernel patching remains the only complete remediation.