Linux Kernel CVE-2026-72136

The primary remediation is upgrading to the patched kernel version for the active stable branch in use: 5.10.261+ for the 5.10 series, 5.15.212+ for 5.15, 6.1.178+ for 6.1, 6.6.145+ for 6.6, 6.12.97+ for 6.12, 6.18.40+ for 6.18, and 7.1.5+ for 7.1. Upstream fix commits are published at https://git.kernel.org/stable/c/04c1aa57d08471b1953bf27c84ac9b3d78d71831 and the seven sibling commits listed in the NVD/EUVD references. Where immediate patching is not possible, restrict unprivileged user namespace creation (set kernel.unprivileged_userns_clone=0 on Ubuntu/Debian derivatives, or apply sysctl kernel.unprivileged_userns_restrict=1 where supported) to limit the set of principals who can obtain CAP_NET_ADMIN in arbitrary namespaces - this narrows but does not eliminate the attack surface for already-privileged local users. Additionally, audit whether any xfrm_interface devices are intentionally placed in cross-namespace configurations; if no such topology is in use, the exploitable condition does not exist and risk is negligible pending patching. Note that disabling unprivileged user namespaces will break rootless container runtimes (rootless Podman, Buildah, and some Kubernetes node configurations), so test in non-production environments before deploying that mitigation.