Linux Kernel CVE-2026-52972

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, or 7.0.10 (or later in your series), or apply the upstream stable commits listed at git.kernel.org (e.g. https://git.kernel.org/stable/c/f8a5203596797f394ff3f9aa4005597a92249802 and the sibling commits). For distribution kernels, track and apply the vendor build referenced in the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-52972 and VEX at https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52972.json. Where immediate patching is not possible, the most effective compensating control is to remove attacker reachability to the AF_ALG interface: block loading of the algif_aead/af_alg modules (e.g. modprobe blacklist or 'install af_alg /bin/true') so unprivileged processes cannot open AF_ALG sockets, or restrict the syscall via seccomp/LSM policy for untrusted workloads and containers - the trade-off is that applications relying on the kernel crypto user-space API will lose that functionality. Restricting local/untrusted-user access to affected hosts also reduces exposure given the local-only attack vector.