Linux Kernel CVE-2026-52957

Apply the vendor-released patched kernel for your branch: upgrade to Linux 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (or later) as appropriate to your running series, then reboot into the new kernel. The fix is published as upstream stable commits at git.kernel.org (e.g., https://git.kernel.org/stable/c/301286c0ccd37d66b0e40786fd35a4f19cdbd88a, https://git.kernel.org/stable/c/7169f326a23d0f547fcd90e68b72fd387622e126); consume it via your distribution's kernel update channel rather than hand-patching where possible. Where immediate patching is not feasible, reduce exposure by ensuring libceph clients only communicate with trusted, authenticated Ceph monitors and OSDs over Ceph's cephx authentication and on a segmented storage network, and by firewalling Ceph traffic so untrusted hosts cannot inject or spoof OSD map messages - the trade-off is that these are network-trust controls that do not eliminate the bug if the cluster itself is compromised. Hosts that do not use CephFS/RBD can blacklist or avoid loading the ceph/libceph kernel modules entirely, at the cost of losing Ceph client functionality.