Linux Kernel CVE-2026-53157

Vendor-released patch: update to a fixed stable kernel - 6.18.36, 7.0.13, or 7.1 (or later) - which replaces the immediate free in phonet_device_destroy() with kfree_rcu() so the phonet_device is released only after an RCU grace period; the fix commits are 71de0177b28da751f407581a4515cf4d762f6296, 52b8f5ef82c886f7cd24617915e4b1579ddfd001 and bff309ea51f1395c1ef8be8b75ce62d28a319113 at git.kernel.org. Where kernels cannot be immediately updated, the most effective compensating control is to avoid loading the Phonet subsystem: if CONFIG_PHONET is a module and unused, blacklist the phonet module (and pn_pep) via modprobe blacklist and add it to an install-false rule, which eliminates the vulnerable code path entirely with essentially no side effect on systems that do not use Nokia cellular-modem connectivity. If Phonet is required, restrict the CAP_NET_ADMIN capability and access to phonet device management to trusted users only to limit who can trigger device teardown, at the cost of tighter administrative delegation. Reference the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-53157 and the stable commits above when scheduling the patch.