Linux Kernel EUVD-2026-28697

Update to Linux kernel 6.19.9 or later for the 6.x stable branch (patch commit d2324a9317f00013facb0ba00b00440e19d2af5e), or kernel 7.0 or later for mainline (patch commit 1797ee11451f1b2be69863a9f5bd43b948813fdf). Distribution-specific patched packages: for RHEL/CentOS use 'yum update kernel' after vendor backport release; for Ubuntu/Debian use 'apt update && apt upgrade linux-image-generic'; for SUSE use 'zypper update kernel-default'. Verify patched kernel with 'uname -r' and reboot to activate. If immediate patching is not feasible, implement defense-in-depth controls: (1) Restrict CAP_SYS_PTRACE and CAP_SYS_ADMIN capabilities in container security policies (Kubernetes PodSecurityPolicy/PodSecurity standards, Docker seccomp profiles) to limit namespace traversal abilities - trade-off is breaking legitimate debugging tools like strace; (2) Enable AppArmor or SELinux mandatory access control with strict namespace access profiles to prevent cross-namespace file descriptor operations - adds operational complexity for legitimate multi-namespace tools; (3) Use user namespaces (CONFIG_USER_NS) with non-overlapping UID/GID ranges to create additional permission boundaries - requires reconfiguring container UID mappings and may break applications expecting specific UIDs. Monitor /proc/[pid]/ns/ access patterns via auditd rules ('auditctl -w /proc/ -p r -k namespace_access') to detect reconnaissance attempts. Workarounds provide partial mitigation only; kernel patching remains the definitive fix. Full advisories and patches: https://git.kernel.org/stable/c/1797ee11451f1b2be69863a9f5bd43b948813fdf.