Linux Kernel CVE-2026-72389

The primary fix is upgrading to a patched kernel: 5.15.212 or later for the 5.15.x LTS branch, 6.1.178 or later for 6.1.x LTS, 6.6.145 or later for 6.6.x LTS, 6.12.97 or later for 6.12.x, 6.18.40 or later for 6.18.x, 7.1.5 or later for 7.1.x, or 7.2-rc2 or later for mainline pre-release; patch commits are indexed at https://git.kernel.org/stable/c/c86579b0a2d201792bcb59316629f4ba4758cfc8 and the six sibling commits in the references. For systems where immediate patching is not feasible, three compensating controls exist with distinct trade-offs: (1) disable unprivileged user namespaces via sysctl kernel.unprivileged_userns_clone=0 (blocks container-based exploitation paths but breaks rootless container workloads); (2) unload or blacklist the bridge kernel module (modprobe -r bridge) where bridged networking is not required, eliminating the attack surface entirely at the cost of bridge functionality; (3) apply seccomp or AppArmor/SELinux policy to restrict network bridge syscalls for untrusted workloads, which reduces risk without breaking legitimate bridging but requires per-workload policy management. NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72389.