Linux Kernel CVE-2026-52988

Apply the upstream stable fix that introduces splice_list_rcu() for hook publication in the nf_tables commit phase; per EUVD the corrected code ships in the 7.0.10 and 7.1 stable series, so update to a kernel build that includes commits 1346be9379639c30877083b12747d4eacb83c24f and a6134e62dba2ea4f760b29d5226907f447c92400 (Upstream fix available via stable-tree commits; map to your distribution's patched package). For distribution kernels, install the vendor erratum kernel that backports these commits and reboot. As a compensating control where patching is delayed, restrict who can manipulate nftables rulesets: ensure unprivileged user namespaces cannot grant CAP_NET_ADMIN (set sysctl user.max_user_namespaces=0 or kernel.unprivileged_userns_clone=0 where available) so only trusted administrators can drive the vulnerable netlink path - the trade-off is that container runtimes and sandboxes relying on user namespaces may break. Confirm exact patched package versions via the NVD and your distribution security tracker before deployment.