Linux Kernel CVE-2026-72235

The primary fix is to upgrade to a patched stable kernel release: 5.10.261 or later (5.10.x series), 5.15.212 or later (5.15.x), 6.1.178 or later (6.1.x), 6.6.145 or later (6.6.x), 6.12.97 or later (6.12.x), 6.18.40 or later (6.18.x), 7.1.5 or later (7.1.x), or 7.2-rc2 or later mainline. Patch commits are confirmed at https://git.kernel.org/stable/c/f19259395b44af67f3c274e34237c295b526b859 (and the other seven SHAs in the references) for distribution packagers applying backports. For systems that cannot be patched immediately, the most effective compensating control is to unload or blacklist the batman-adv kernel module (rmmod batman-adv; echo 'blacklist batman-adv' >> /etc/modprobe.d/batman-adv-blacklist.conf) - this entirely eliminates the attack surface with no side effect unless the host is intentionally acting as a mesh networking node. Network-level controls (blocking layer-2 traffic to the host) partially reduce adjacent-network exposure but do not eliminate it in mesh topologies.