Linux Kernel EUVD-2026-27750

Apply vendor-supplied kernel patches immediately for affected versions. Specific fix versions: upgrade to Linux 5.10.252 or later for 5.10.x branch, 5.15.202+ for 5.15.x LTS, 6.1.165+ for 6.1.x LTS, 6.6.128+ for 6.6.x LTS, 6.12.75+ for 6.12.x, 6.18.16+ for 6.18.x, 6.19.6+ for 6.19.x, or 7.0+ for mainline. All patches implement bounds checking before reading TCP option length bytes in net/netfilter/xt_tcpmss.c. Consult your Linux distribution's security advisory channels (e.g., RHSA, USN, SUSE Security Update) for distribution-specific kernel packages. For systems unable to patch immediately, compensating controls include: (1) Disable xt_tcpmss module and remove TCP MSS clamping iptables/nftables rules if not operationally required - this eliminates the vulnerable code path but may cause MTU issues for NATed/VPN traffic; verify application compatibility before implementing. (2) Implement strict network ingress filtering to block malformed TCP packets at network perimeter before reaching vulnerable hosts - requires deep packet inspection capability and may impact performance; effectiveness depends on attacker's ability to bypass filtering. (3) Deploy kernel runtime protection mechanisms like grsecurity/PaX if available for your distribution - adds exploit mitigation but does not fix root cause. Patch references and validation commits available at https://git.kernel.org/stable/c/735ee8582da3d239eb0c7a53adca61b79fb228b3 and related stable tree commits. Reboot required after kernel update to activate patched code.