Linux Kernel CVE-2026-72052

The primary remediation is to upgrade to a patched Linux kernel: 6.18.40 or later on the 6.18.x series, 6.12.97 or later on 6.12.x, 6.6.145 or later on 6.6.x, 6.1.178 or later on 6.1.x, 5.15.212 or later on 5.15.x, 5.10.261 or later on 5.10.x, 7.1.5 or later on 7.1.x, or any 7.2+ kernel. Upstream patch commits are indexed at https://git.kernel.org/stable/c/0caa9f348f8b5356900de77b0bb89a697c4aff20 and the seven related stable-tree commits listed in the NVD references. If immediate patching is not feasible, the most targeted compensating control is to remove CAP_NET_ADMIN from untrusted container or process contexts - for example, via Kubernetes securityContext capability drops or seccomp profiles - which eliminates the attacker's required prerequisite; the trade-off is that workloads relying on network configuration within their namespace will lose that capability. Alternatively, blacklisting the ip6_gre kernel module (adding modprobe.blacklist=ip6_gre to the kernel command line or an /etc/modprobe.d entry) prevents exploitation entirely but disables all IPv6 GRE and ERSPAN tunnel functionality across the host. Both workarounds are operational in nature and should be treated as temporary bridges to patching.