Linux Kernel CVE-2026-72374

The primary fix is to upgrade to a patched Linux kernel stable release appropriate to the series in use: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc2 and later mainline. Patch commits for each stable branch are available via the Linux stable tree at https://git.kernel.org/stable/c/26b737b3769e92493fe94c34620399d93ca231ae and the additional commits referenced in the CVE. For systems that cannot be patched immediately, the most effective compensating control is to unmount all AFS volumes and unload the AFS kernel module (modprobe -r kafs), which eliminates the rxrpc callback listener entirely; this renders AFS-hosted filesystems unavailable during the interim period. Network-level mitigation can be applied by blocking inbound rxrpc traffic (UDP port 7001 by default) from untrusted source addresses using iptables or nftables, reducing external attack surface while preserving AFS connectivity from trusted AFS servers - though this does not eliminate the risk from a compromised AFS server on the trusted network. Systems confirmed not to use AFS should blacklist the kafs module in /etc/modprobe.d/ as a permanent hardening measure.