Linux Kernel CVE-2026-64000

Vendor-released patch: upgrade to a fixed stable kernel - 6.1.176, 6.6.143, 6.12.93, or 6.18.35 (or later) matching your branch, as published in the kernel.org stable commits (https://git.kernel.org/stable/c/fbd0662f9c9a66e8cc3df3099cca8ed6d3837cc7 and related). Apply your distribution's corresponding kernel update once available. If patching must be deferred and HSR is not required, unload or blacklist the hsr kernel module (rmmod hsr / blacklist hsr) to eliminate the attack surface entirely - the trade-off is loss of HSR ring redundancy, so only do this on hosts that do not depend on it. Where HSR is required, restrict the redundancy ring to trusted, physically secured switch ports and segment it from general-purpose LANs so untrusted devices cannot inject crafted supervision frames; the trade-off is stricter network topology management. These controls reduce exposure but do not remove the code defect, so schedule the kernel upgrade.