Linux Kernel SMB client EUVD-2026-28634

Upgrade to patched Linux kernel versions: 6.6.136+ for 6.6.x series, 6.12.84+ for 6.12.x series, 6.18.25+ for 6.18.x series, 7.0.2+ for 7.0.x series, or 7.1-rc1+ for mainline. Specific fix commits are available for backporting to custom kernels via the referenced git.kernel.org URLs. For systems where immediate kernel updates are not feasible, implement network-level controls to restrict SMB client connections to trusted, verified server infrastructure only-use firewall rules to block outbound SMB ports (445/TCP, 139/TCP) except to allowlisted internal servers, and disable opportunistic SMB mounting features if available. Note that blocking SMB entirely may disrupt legitimate file sharing workflows. Organizations using SELinux or AppArmor can create policies restricting which processes can initiate SMB mounts, limiting attack surface to privileged system services rather than user applications. These compensating controls significantly reduce exposure but do not eliminate the vulnerability-prioritize kernel patching. No known workaround fully mitigates the issue without patching, as the vulnerability is in core kernel code triggered during ACL parsing.