Linux Kernel CVE-2026-53068

Vendor-released patch: update to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 7.0.10, or 6.18.33 (or later) for the matching series, which add the check_add_overflow() guard to the AFBC size validation. Apply the corresponding stable commit from git.kernel.org (e.g. https://git.kernel.org/stable/c/a3a2a9bdc0f9c2d863a5a290cb2d4a565f7268e7) if you maintain a custom kernel. Where immediate patching is not possible, the practical compensating control is to restrict access to the DRM render/primary device nodes (/dev/dri/*) to trusted users only - tightening membership of the 'video'/'render' groups and udev permissions - which prevents untrusted local users from submitting framebuffers but will break legitimate unprivileged GPU/display clients; on systems that do not actually use Arm Mali komeda hardware, the driver can be left unloaded/unbuilt to remove the attack surface entirely. Refer to https://nvd.nist.gov/vuln/detail/CVE-2026-53068 for tracking.