Linux Kernel CVE-2026-64002

Vendor-released patch: update to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or 7.1 (or later on your branch), or the distribution kernel that backports the corresponding stable commit (e.g. https://git.kernel.org/stable/c/ecf45080a4d3f4526cacb8b14060fe3b49a6913b). On managed distributions, apply the vendor kernel errata and reboot, since a running kernel remains vulnerable until replaced; live-patching may not cover a teardown-ordering fix, so verify with the vendor. Where immediate patching is not possible, reduce the attack surface that lets unprivileged users trigger network-namespace teardown: set kernel.unprivileged_userns_clone=0 (or sysctl user.max_user_namespaces=0) to block unprivileged netns creation - note this can break container runtimes, sandboxed browsers, and CI tooling that rely on user namespaces. Restricting who can create namespaces (seccomp/AppArmor profiles limiting clone/unshare, or confining workloads to trusted tenants) is a lower-collateral alternative but does not eliminate the race for privileged or authorized namespace users.