Linux Kernel EUVD-2026-26629

Upgrade to patched kernel versions: 5.10.253 or later for 5.10.x branch, 5.15.203+ for 5.15.x, 6.1.168+ for 6.1.x, 6.6.134+ for 6.6.x, 6.12.81+ for 6.12.x, 6.18.22+ for 6.18.x, 6.19.12+ for 6.19.x, or kernel 7.0+ for mainline. Vendor patches are available at https://git.kernel.org/stable/ with specific commits listed in references. Organizations unable to immediately patch should implement compensating controls: restrict BPF program loading to trusted administrative users only by ensuring unprivileged_bpf_disabled sysctl is set to 1 (echo 1 > /proc/sys/kernel/unprivileged_bpf_disabled) and removing CAP_BPF/CAP_SYS_ADMIN capabilities from untrusted processes. Note that disabling unprivileged BPF may break observability tools like systemd, cilium, or performance monitoring solutions that rely on user-space BPF access. For container environments, use seccomp profiles to block bpf() syscall for untrusted workloads, understanding this prevents legitimate BPF-based networking and tracing in those containers. Apply kernel live patching if available for your distribution (kpatch/livepatch) to avoid reboot downtime.