Linux Kernel CVE-2026-53150

The primary fix is upgrading to a patched Linux kernel version: 5.10.259 or later for the 5.10.x longterm branch, 5.15.210 or later for 5.15.x, 6.1.176 or later for 6.1.x, 6.6.143 or later for 6.6.x, 6.12.94 or later for 6.12.x, 6.18.36 or later for 6.18.x, 7.0.13 or later for 7.0.x, or 7.1 for mainline. Upstream commit references are available at https://git.kernel.org/stable/c/99d9dbad1463afb510d42c9714f846361d1b726d and seven additional stable-tree commits. For systems where kernel patching is not immediately possible, a compensating control is to restrict or block user access to the Thunderbolt/USB4 subsystem: unloading the thunderbolt kernel module (rmmod thunderbolt) prevents the code path from being reachable, though this disables Thunderbolt device connectivity as a trade-off. Alternatively, restricting physical Thunderbolt port access and ensuring only trusted users have local shell access limits the attack surface, since AV:L/PR:L requires a local low-privileged session. Advisory details are available at https://nvd.nist.gov/vuln/detail/CVE-2026-53150 and tracked under EUVD-2026-39241.