Linux Kernel CVE-2026-63847

Apply your distribution's kernel update that includes this fix (upstream cherry-pick of commit 3216a7f4e2642bda5fd14f57586e835ae9202587); Patch available per vendor advisory, with fixed stable versions including 6.6.141, 6.12.91, 6.18.33, 7.0.10, and 7.1. Reference the stable commits at https://git.kernel.org/stable/c/63691e396105611173072ad548fc2b68831ecf23 (and the sibling commits 4d96e3cb, 3a96fee6, 694fe016, 79405e77) and track your distro's advisory for the backported package. As a compensating control until patched, restrict local access to GPU render/DRM device nodes (e.g., tighten permissions on /dev/dri/renderD* to trusted users/groups) since exploitation requires local GPU command submission; the trade-off is that unprivileged GPU compute or hardware-accelerated JPEG workloads for restricted users will break. There is no network-facing exposure to block.