Linux Kernel CVE-2026-72012

The primary fix is upgrading to a patched Linux kernel stable release: 6.6.145 or later on the 6.6 LTS branch, 6.12.97 or later on the 6.12 LTS branch, 6.18.40 or later on the 6.18 branch, 7.1.5 or later on the 7.1 branch, or 7.2-rc3 or later on mainline. Upstream patches are indexed at https://nvd.nist.gov/vuln/detail/CVE-2026-72012 and the individual stable commits at https://git.kernel.org/stable/c/. Distribution-specific advisories (Red Hat, Ubuntu, SUSE, Debian) should be consulted for packaged kernel updates, as they may ship backported fixes to earlier version strings. As a compensating control on unpatched systems, restrict tracefs mount permissions to root-only (e.g., mounting with mode=700 or removing group/world read bits on /sys/kernel/tracing), which prevents unprivileged users from loading or interacting with the osnoise tracer - this limits legitimate tracing capabilities for non-root users as a trade-off. On systems where the osnoise tracer is not operationally needed, building the kernel with CONFIG_OSNOISE_TRACER not set eliminates the vulnerable code path entirely, though this requires kernel recompilation.