Linux Kernel CVE-2026-68118

Upgrade to a patched Linux kernel version - specifically 6.18.42, 7.1.6, or 7.2-rc5 or later - per fixes confirmed at kernel.org stable commits: https://git.kernel.org/stable/c/234f9ffbd9b2c1b24ec67200ea3cff07401bec48, https://git.kernel.org/stable/c/22cec809b048495310f206d9abbcdbbfbdce3ae3, and https://git.kernel.org/stable/c/a28c4fcbf774e23b4779cae468e3497a5ad1f4a1. The NVD entry is available at https://nvd.nist.gov/vuln/detail/CVE-2026-68118. Distribution maintainers should be monitored for downstream security advisories incorporating these commits into vendor kernels. Where immediate kernel patching is not feasible, deploying stateful firewall rules (iptables/nftables with conntrack) that enforce TCP state tracking and drop RST segments not matching established connection entries provides partial mitigation; note this adds connection-tracking memory overhead and does not fully substitute for the kernel-level fix since in-window RSTs during the SYN-RECEIVED phase may still be processed before conntrack confirms state. Implementing BCP38 ingress filtering at the network perimeter to drop spoofed source addresses reduces off-path blind RST injection risk but does not protect against on-path attackers. Rate-limiting SYN-RECEIVED state exposure at the network edge (via SYN cookies or reduced SYN backlog timeouts) narrows the attack window at the cost of potentially impacting high-connection-rate services.