Linux Kernel EUVD-2026-28690

Upgrade to patched Linux kernel versions: 6.12.78 or later for 6.12.x series, 6.18.19 or later for 6.18.x series, 6.19.9 or later for 6.19.x series, or 7.0 for mainline. Patches replace vulnerable MAC comparison with crypto_memneq() constant-time comparison primitive, available in upstream commits 8be6ed64966da48b6c4726918f106c18742a5125 (mainline), a269cbdc442f8658bca35383e34b9d0b0ff95a1c, 080b0e210088296dd50d6637c06c1db14246adfe, and 67edfec516d30d3e62925c397be4a1e5185802fc (stable branches) at https://git.kernel.org/stable/. Distributions should apply vendor-specific kernel updates when released. If immediate patching is not feasible, disable TCP-AO on affected systems as compensating control - remove TCP-AO configuration from sysctl settings and connection configurations, reverting to IPsec or TLS for connection authentication instead. Note this workaround eliminates TCP-AO functionality entirely but removes attack surface. Network segmentation to prevent attacker positioning on TCP connection paths provides defense-in-depth but does not eliminate risk from insider threats or compromised adjacent systems. Monitor for unusual patterns of TCP connection attempts or timing probes as potential reconnaissance activity, though detection is challenging given low signal-to-noise ratio of legitimate connection variability.