Linux Kernel CVE-2026-72042

The primary fix is to upgrade to a patched Linux kernel version: 6.1.157 or later for the 6.1 LTS branch, a post-6.6.113 stable release with commit 7be349d4 for the 6.6 LTS branch, a post-6.12.54 release with commit ddbb6e3d for the 6.12 LTS branch, 6.18.40 or later for the 6.18 branch, or 7.1.5 and later for the 7.1 series. Distribution kernels from major vendors (RHEL, Ubuntu, SUSE, Debian) will ship backported fixes - monitor vendor security advisories. As a compensating control where patching is not immediately possible, restrict access to IPMI device nodes (typically /dev/ipmi0 and /dev/ipmiX) to root-only by removing world/group read-write permissions; this prevents unprivileged local users from interacting with the IPMI subsystem and eliminates the PR:L attack vector, with the trade-off that non-root IPMI management tools will require elevated invocation. If IPMI functionality is not operationally required on a given host, blacklisting the ipmi_msghandler, ipmi_si, and related modules via /etc/modprobe.d entirely removes the attack surface with no functional impact on standard workloads. Patch commits can be reviewed at the kernel.org stable tree links in the references.