Linux Kernel EUVD-2026-27777

Update to patched kernel versions: 6.6.128 or later for 6.6.x branch, 6.12.75 or later for 6.12.x branch, 6.18.16 or later for 6.18.x branch, 6.19.6 or later for 6.19.x branch, or 7.0 stable release when available. Upstream fixes are tracked in commits 953953abb66e52c224057ab91e404284fefeab62, 601dd3b79769b38d30b693c40afdb2a4b7edf9d0, 3969db6b22e3d90d8c5f22ac1a7fe0350a94c136, 8c59eeeeffa1524ef57e173a89a1a3ff539888d5, and 96c4af418586ee9a6aab61738644366426e05316 available at https://git.kernel.org/stable/. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: (1) Disable CIFS client support entirely via 'rmmod cifs' and block module loading - this eliminates attack surface but removes all SMB mount capability, impacting users requiring Windows file share access; (2) Restrict CIFS mount operations to root-only via filesystem policy (e.g., remove setuid on mount.cifs helpers) - reduces exposure from user-initiated mounts to untrusted servers but may disrupt workflows where non-privileged users need SMB access; (3) Implement mandatory network access controls blocking SMB/CIFS ports (TCP 445, 139) to untrusted networks - prevents connection to attacker-controlled SMB servers but requires careful firewall rule design to avoid blocking legitimate internal file servers. Each mitigation trades functionality for security; patching remains the recommended solution. Verify fix application by checking kernel version with 'uname -r' and confirming CIFS module version includes the tc_lock corrections.