Linux Kernel CVE-2026-72054

Update to a patched kernel release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5, selecting the branch corresponding to your running kernel series; upstream fix commits are available at https://git.kernel.org/stable/c/1caf737e625143c6f23c32d2b747b1a3e42e5699 and the seven additional stable commits listed in NVD references. Where immediate kernel upgrade is operationally infeasible, the following compensating controls apply with noted trade-offs: removing or preventing load of the ip_vti module (modprobe -r ip_vti; echo 'install ip_vti /bin/false' >> /etc/modprobe.d/disable-vti.conf) fully eliminates the attack surface but disables all VTI-based IPsec tunnels, potentially breaking VPN infrastructure. Restricting CAP_NET_ADMIN grant to only fully trusted container workloads via seccomp-bpf profiles or LSM policy (SELinux/AppArmor) reduces exposure without breaking existing tunnels but requires audit of all container privilege grants. Disabling unprivileged user namespace creation (sysctl -w kernel.unprivileged_userns_clone=0) limits the namespace proliferation paths that establish the cross-namespace condition, but may break some container runtimes that rely on rootless operation. No vendor advisory URL beyond NVD was identified; monitor distribution security channels for downstream advisories.