Linux Kernel CVE-2026-72055

The primary remediation is to upgrade to a patched stable kernel release: 5.10.261 or later, 5.15.212 or later, 6.1.178 or later, 6.6.145 or later, 6.12.97 or later, 6.18.40 or later, or 7.1.5 or later (mainline 7.2-rc1+). Upstream fix commits are available at https://git.kernel.org/stable/c/0b2f9c908f930ec4be17d389723f9a202d6a883c and related stable-branch commits listed in the NVD references. For environments that cannot immediately patch, a compensating control is to restrict CAP_NET_ADMIN grants in container runtimes and Kubernetes pod security contexts - specifically, avoid granting NET_ADMIN capability to untrusted workloads and enforce pod security admission policies that block it. In Docker, avoid --cap-add=NET_ADMIN for untrusted images. Note that withholding CAP_NET_ADMIN may break legitimate networking features in the affected containers (VPN clients, custom routing, network debugging tools). Another control is to disable vti6 module loading via modprobe blacklist (blacklist ip6_vti in /etc/modprobe.d/), which prevents creation of new vti6 devices entirely - trade-off is loss of IPv6-in-IPv6 VPN tunnel functionality. Consult your distribution's security advisories for distribution-specific package updates.