Linux Kernel CVE-2026-53057

Apply the vendor-released stable kernel fixes: upgrade to Linux 6.18.33, 7.0.10, or 7.1 (or backport the three upstream fix commits 3f917d9b, d99d1c13, and f5c262b5 from https://git.kernel.org/stable/c/ ) which add riscv_iommu_iodir_iotinval() to invalidate caches after DDT/PDT updates. For distribution kernels, take the vendor build that incorporates these commits. Until patched, reduce exposure by avoiding device passthrough on affected RISC-V hosts: disable or restrict VFIO/IOMMU device assignment to untrusted guests or userspace, and limit which local principals can attach/detach devices or manage PASID contexts (this disables passthrough-based workloads, the main trade-off). Note the issue only manifests on RISC-V with the IOMMU active, so non-RISC-V or IOMMU-disabled deployments need no action. There is no effective in-kernel workaround for the missing invalidation itself short of the code fix, so prioritize patching over compensating controls where passthrough is required.