Linux Kernel CVE-2026-72151

The primary fix is to upgrade to a patched kernel release: Linux 6.12.97 or later for the 6.12 stable series, Linux 6.18.40 or later for the 6.18 series, Linux 7.1.5 or later for the 7.1 series, or any build incorporating the 7.2-rc1 fix commit. Patch commits are available at the kernel stable git tree links in the references. The fix installs crypto_req_done as the KPP completion callback and wraps both operations in crypto_wait_req(), making the code wait for async completion before freeing the request; this is a no-op for synchronous backends and introduces no behavioral change on unaffected hardware. If immediate kernel upgrade is not feasible on platforms running async KPP hardware, a viable compensating control is to blacklist or unload the specific async KPP kernel module (atmel-ecc, hpre, or keembay-ocs depending on the platform), forcing fallback to the synchronous software ecdh-nist-p256 implementation; this eliminates the async race at the cost of losing hardware crypto acceleration and potentially reducing TPM session establishment throughput. Disabling the TPM device entirely (via firmware or CONFIG_TCG_TPM=n) also eliminates the attack path but removes all TPM-dependent security features including Secure Boot measurements, disk encryption key sealing, and remote attestation. Distribution-specific kernel updates from Red Hat, Ubuntu, SUSE, and Debian should be monitored for backported patches to their supported kernel versions.