Linux Kernel EUVD-2026-25555

Vendor-released patch: update to a fixed stable kernel - 5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, or 7.0 (or later on each branch) - matching your running series, or apply the upstream commits listed at https://git.kernel.org/stable/c/ (e.g. a7db57ccca21, 575faea557f1). Distribution users should install the vendor-packaged fix, for example via Ubuntu USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1) or the equivalent Red Hat/SUSE erratum. If patching must be deferred and TIPC is not required, the most effective compensating control is to prevent the vulnerable code from loading at all: blacklist the module (add 'blacklist tipc' and 'install tipc /bin/true' in modprobe.d) so the tipc kernel module cannot be autoloaded - this eliminates the attack surface entirely but breaks any application relying on TIPC cluster messaging. Where TIPC is genuinely needed, restrict which nodes can join the TIPC network via bearer/link ACLs and network segmentation so only trusted cluster members can send group ACK traffic, and monitor for sockets stuck reporting broadcast congestion so operators can recreate affected groups.