Linux Kernel CVE-2026-72107

The primary fix is to upgrade to a patched stable kernel release: 5.10.261 or later for the 5.10 LTS branch, 5.15.212 or later for 5.15 LTS, 6.1.178 or later for 6.1 LTS, 6.6.145 or later for 6.6 LTS, 6.12.97 or later for 6.12 LTS, 6.18.40 or later for the 6.18 branch, 7.1.5 or later for 7.1, or 7.2-rc3 and later for mainline. Upstream fix commits are indexed at https://git.kernel.org/stable/c/ (see eight commit hashes in references). For systems where an immediate kernel update is not feasible, the most effective compensating control is to avoid or discard dm-era tables configured with a non-zero start sector (dmsetup targets where the table start offset is not zero); note that most production LVM thin-pool configurations do not use dm-era and are unaffected. Disabling or unloading the dm-era kernel module (modprobe -r dm_era) eliminates the attack surface entirely with the trade-off that any dm-era-dependent storage configuration will fail to load. Restricting CAP_SYS_ADMIN to only necessary processes via seccomp or AppArmor profiles reduces exposure in multi-tenant environments.