Linux Kernel CVE-2026-64548

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or mainline 7.2-rc1 or later - matching your kernel series; the fix adds an explicit overflow check before the page allocation in bpf_msg_push_data(). The stable commits are at https://git.kernel.org/stable/c/db77b6bb6e6edb79b10b4efcce346eec5582d588, https://git.kernel.org/stable/c/ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d, and companions (f1644c95, a12b1575, 4e40056b, bd004716, 0c0a8ed8, 888706a7); apply your distribution's corresponding kernel update rather than cherry-picking where possible. If immediate patching is not feasible, reduce exposure by restricting who can load BPF programs: set kernel.unprivileged_bpf_disabled=1 to block unprivileged eBPF, and disable unprivileged user namespaces (user.max_user_namespaces=0 or kernel.unprivileged_userns_clone=0) to prevent capability acquisition - the trade-off is breaking container runtimes and sandboxes that rely on user namespaces or unprivileged BPF. On hosts that do not need sockmap-based traffic steering, avoid loading BPF_PROG_TYPE_SK_MSG programs; the side effect is loss of any sockmap-based redirection/observability tooling.