Linux Kernel EUVD-2026-27717

The primary fix is to apply one of three upstream kernel patches available in the Linux stable tree: commit 8d8a878ef60801d867119b3df6a93e2982d62a71 (https://git.kernel.org/stable/c/8d8a878ef60801d867119b3df6a93e2982d62a71), commit d498bd168494ad4a4bce16192bfb9ce04ca19c9a (https://git.kernel.org/stable/c/d498bd168494ad4a4bce16192bfb9ce04ca19c9a), or commit 3afa4da38802a4cba1c23848a32284e7e57b831b (https://git.kernel.org/stable/c/3afa4da38802a4cba1c23848a32284e7e57b831b), each targeting a different stable branch. Tagged release versions incorporating these commits have not been independently confirmed beyond the commit hashes - consumers of Red Hat or SUSE distributions should apply errata once published by those vendors. For environments where kernel patching is not immediately feasible, a compensating control is to restrict unprivileged user-namespace mounts by setting kernel.unprivileged_userns_clone=0 (where supported) or kernel.userns_restrict, which blocks low-privileged users from mounting arbitrary EROFS images; note this trade-off disables container and sandbox workloads that rely on unprivileged user namespaces. Additionally, auditing which users have the CAP_SYS_ADMIN capability or access to loop devices limits the attack surface.