Linux Kernel EUVD-2026-38033

Upgrade to a fixed stable kernel: vendor-released patches are available in Linux 6.18.36, 7.0.13, and 7.1 (and backported stable branches), with upstream fix commits ecf8904067dc, dcdce3bc9f08, and d289d5307762 available at git.kernel.org/stable. Apply your distribution's corresponding patched kernel package once published, since most production systems run vendor kernels rather than mainline. Where immediate patching is not possible, restrict CAP_NET_ADMIN to trusted users only and tighten container runtime privileges so untrusted workloads cannot perform rtnetlink device-move operations on host network devices; the trade-off is that legitimate in-container network management requiring CAP_NET_ADMIN will be constrained. If the ip6_vti functionality is unused, avoid loading the ip6_vti module (blacklist via modprobe), which prevents creation of the vulnerable fallback device at the cost of disabling IPv6 VTI tunneling. Advisory and tracking URLs: https://nvd.nist.gov/vuln/detail/CVE-2026-52909 and https://vuldb.com/vuln/372371.