Linux Kernel CVE-2026-52954

Apply the vendor-released stable kernel update for your branch: upgrade to 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 or later, whichever matches your series, then reboot into the patched kernel. The fix commits are published at git.kernel.org/stable (e.g. https://git.kernel.org/stable/c/c7bf7864e2924fa5508ac270b0e9364bc13d5a6c) and tracked at https://nvd.nist.gov/vuln/detail/CVE-2026-52954. If you cannot patch immediately, reduce exposure by not mounting CephFS or mapping RBD images from untrusted clusters, restricting the Ceph storage/cluster network so only trusted, authenticated monitors and OSDs can reach client hosts (e.g. dedicated storage VLAN, firewalling the Ceph mon/OSD ports), and enabling Ceph cephx authentication and msgr2 secure mode to make monitor/OSD impersonation and MITM injection of malicious OSD maps harder; the trade-off is that these are network/trust controls that do not remove the underlying parsing flaw, and they offer no protection if a legitimate monitor or OSD node is itself compromised.