Linux Kernel ibmvfc EUVD-2026-24807

Upgrade to patched kernel versions: 5.10.253+ (LTS), 5.15.203+ (LTS), 6.1.168+ (LTS), 6.6.131+ (stable), 6.12.80+ (stable), 6.18.21+ (stable), 6.19.11+ (stable), or 7.0+ (mainline). Upstream patches available at https://git.kernel.org/stable/c/a007246cb6c9ebdc93dafbf63cc2d43d98f402cc (mainline) and branch-specific commits listed in NVD references. The fix implements input validation by clamping num_written to max_targets before assignment to vhost->num_targets (vhost->num_targets = min(mad->num_written, vhost->max_targets)). For IBM Power environments unable to immediately patch, implement compensating controls: (1) Restrict VIO server access to trusted administrators only, eliminating untrusted or multi-tenant VIO deployments - this removes the threat actor capability but may conflict with cloud/shared infrastructure models; (2) Enable kernel memory poisoning (CONFIG_PAGE_POISONING=y, page_poison=1) to reduce information value of leaked memory, though this incurs 5-15% performance overhead and does not prevent disclosure; (3) Deploy network segmentation isolating VIO server management networks from untrusted zones, reducing adjacent network attack surface but not eliminating insider threats with VIO access. No configuration-based workaround exists to disable the vulnerable code path without losing ibmvfc functionality entirely. Patching remains the only complete remediation.