Linux Kernel CVE-2026-53016

Vendor-released patch: update to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (or later) depending on your maintained branch - which replaces the hardcoded AES_BLOCK_SIZE restore with crypto_skcipher_ivsize(); the corresponding commits are at git.kernel.org/stable (e.g. https://git.kernel.org/stable/c/939061b2d0f7f15114e34b4ce878ef50ff4089c3). Where immediate patching is not possible, concrete compensating controls include disabling or restricting the AF_ALG userspace crypto interface (for example via seccomp/LSM policy blocking the AF_ALG socket family, or building/configuring without CONFIG_CRYPTO_USER_API_SKCIPHER), which removes the unprivileged trigger path at the cost of breaking applications that rely on kernel crypto offload through AF_ALG; alternatively, blacklisting/unloading the ccp module on hosts that do not require AMD crypto offload eliminates the vulnerable driver but disables hardware-accelerated crypto on AMD platforms. Confirm exact applicable version against your distribution's backported advisory before deploying.