Linux Kernel CVE-2026-64253

The primary fix is upgrading to a patched kernel version: 6.12.95 or later for the 6.12.x stable branch, 6.18.38 or later for the 6.18.x branch, or 7.1.3 or later for the 7.x branch; 7.2-rc1 also contains the fix. Patches are confirmed available via upstream kernel stable commits at the git.kernel.org links listed above, and per vendor (Linux kernel project) advisory. For systems that cannot immediately apply the patch, restricting unprivileged fork access via seccomp profiles, user namespace restrictions (kernel.unprivileged_userns_clone=0 where supported), or mandatory access control policies (SELinux, AppArmor) can reduce the attack surface by limiting which processes can invoke fork in contexts involving block I/O plugging - however, these are partial mitigations and do not eliminate the invariant violation. Disabling access to block I/O-intensive workloads for untrusted users is an additional compensating control with potential performance trade-offs. No complete workaround short of patching the kernel exists.