Linux Kernel CVE-2026-53211

Upgrade to Linux kernel 6.18.36 (stable) or 7.0.13 (stable); the 7.1-rc series fix targets the 7.1 stable release. Distribution maintainers should apply the upstream stable commits referenced above; apply distribution-provided kernel updates as they become available. As a compensating control on unpatched systems, restricting CAP_NET_ADMIN inside containers (e.g., dropping the capability in Kubernetes security contexts or Docker run flags) prevents tenants from constructing the triggering rule, though this also disables legitimate network configuration operations and may break workloads requiring interface management. Where bridge-based network filtering is not operationally required, unloading the nft_meta_bridge module (modprobe -r nft_meta_bridge) eliminates the vulnerable code path entirely without affecting non-bridge netfilter rules; note that this will break nftables policies applied to bridge interfaces. No vendor advisory URL beyond the NVD entry and upstream git commits has been identified at time of analysis.