Linux Kernel EUVD-2026-25463

Upgrade to patched kernel versions: 5.10.253+ for 5.10.y LTS, 5.15.203+ for 5.15.y LTS, 6.1.168+ for 6.1.y LTS, 6.6.131+ for 6.6.y stable, 6.12.80+ for 6.12.y, 6.18.21+ for 6.18.y, 6.19.11+ for 6.19.y, or 7.0+ for mainline. Upstream fix commits are available at https://git.kernel.org/stable/c/b9c310d72783cc2f30d103eed83920a5a29c671a and related stable branch URLs in references. If immediate patching is not feasible, consider these compensating controls with their trade-offs: (1) Disable the CAN gateway module entirely with 'modprobe -r can-gw' or blacklist it in /etc/modprobe.d/ - this prevents all CAN frame routing/manipulation functionality, acceptable if CAN gateway features are not required; (2) Restrict CAP_NET_ADMIN capability using Linux security modules (AppArmor, SELinux) or container capabilities dropping - limits who can configure CAN gateways but may break legitimate administrative tools; (3) If running in containers, ensure CAN network namespaces are isolated and CAP_NET_ADMIN is dropped from container capabilities - reduces attack surface but requires careful orchestration configuration. Note that simply filtering CAN traffic at network level is ineffective since the vulnerability is triggered by local configuration, not by malicious CAN frames on the bus. Organizations should audit which systems actually require CAN gateway functionality before applying mitigations.