Linux Kernel CVE-2026-64046

Vendor-released patch: upgrade to a fixed stable release for your branch - 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1 (or later) - using the corresponding fix commits published at https://git.kernel.org/stable/c/ (e.g., 49a5faaa471ddcd37b6893970c9916eb836e7c31 and the branch-matched siblings). Apply your distribution's kernel update once it incorporates these commits and reboot. If immediate patching is not possible and you need a compensating control, the exposure is limited to the in-kernel TLS path, so you can avoid kTLS by disabling the tls module/offload (do not load net/tls or disable TLS_DEVICE/TLS_SW usage in affected services) and instead terminate TLS in userspace libraries; the trade-off is loss of kTLS performance/offload benefits for those workloads. Restricting which local users/containers can open kTLS sockets reduces reachable attack surface. Verify the fix landed by confirming your running kernel version is at or above the branch-specific fixed release above; do not rely on version strings alone if you carry backported patches.