Linux Kernel CVE-2026-72067

Upgrade to a patched kernel stable release: 5.10.261 or later on the 5.10 LTS branch, 5.15.212 or later on 5.15 LTS, 6.1.178 or later on 6.1 LTS, 6.6.145 or later on 6.6 LTS, 6.12.97 or later on 6.12 LTS, 6.18.40 or later on 6.18, or 7.1.5 or later on the 7.1 branch; the 7.2-rc1 mainline tree also contains the fix. All patch commits are published at https://git.kernel.org/stable/c/. For systems that cannot be immediately patched, restricting access to CPU hotplug controls via seccomp or AppArmor profiles - specifically blocking writes to /sys/devices/system/cpu/cpuN/online - reduces exposure but disables dynamic CPU hotplug functionality entirely, which may impact power management and NUMA balancing workloads. Ensuring only processes with genuine operational need hold CAP_SYS_ADMIN further limits the attack surface. Monitoring kernel ring buffer logs (dmesg) for unexpected CPU hotplug state messages provides detection capability without preventing the error-masking condition itself.