Linux Kernel CVE-2026-53268

Vendor-released patch: update to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1 (or later) on the matching branch, applying your distribution's backported package as it ships the corresponding stable commit (git.kernel.org/stable/c/0afc802160af and the other listed hashes). Until patched, the most effective compensating control is to disable the IRC connection-tracking helper entirely, which is appropriate for nearly all environments given its obsolescence: avoid loading nf_conntrack_irc (blacklist the module) and remove any nftables/iptables 'ct helper set irc' assignments or the legacy ports= helper binding; the only side effect is that active-mode IRC DCC transfers will no longer be auto-permitted through a stateful firewall, which is rarely needed in 2026. If IRC tracking must remain, restrict which interfaces/source networks can reach the helper-tracked ports to trusted segments to reduce remote exposure. Reference the NVD advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-53268) for cross-tracking.