Linux Kernel EUVD-2026-26641

Update to patched kernel versions: 6.19.12 or later for the 6.x stable series, or 7.0 or later for mainline kernels. Apply vendor-provided patches from https://git.kernel.org/stable/c/5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9ef (stable tree fix) or https://git.kernel.org/stable/c/629ec78ef8608d955ce217880cdc3e1873af3a15 (alternative stable branch). Organizations unable to immediately patch should consider workarounds with these trade-offs: (1) Disable MPLS kernel modules if not required for routing operations (modprobe -r mpls_router mpls_iptunnel mpls_gso) - this eliminates attack surface but breaks MPLS-dependent routing configurations; (2) Restrict access to MPLS configuration interfaces via filesystem permissions on /proc/sys/net/mpls/* and netlink socket capabilities (CAP_NET_ADMIN) to trusted administrative accounts only - reduces attacker pool but does not prevent exploitation by compromised privileged processes; (3) Deploy kernel runtime integrity monitoring (IMA/EVM) to detect potential exploitation attempts via abnormal MPLS table operations - provides detection but not prevention. Note that disabling MPLS will cause routing failures in environments using label-switched paths for traffic engineering or VPN services.