Linux Kernel EUVD-2026-38707

The primary fix is to upgrade to a patched Linux kernel version: 7.1 or later, 7.0.11 or later in the 7.0.x stable series, or 6.18.34 or later in the 6.18.x stable series, per EUVD patch metadata. Distribution maintainers should apply the upstream stable commits referenced at the kernel.org stable tree (commits 719007c, 05305e8, bddc092). For systems that cannot be immediately patched, a compensating control is to restrict access to macvtap character devices using filesystem permissions or seccomp/LSM policy (SELinux or AppArmor device rules) so only trusted processes can open the device - this eliminates unprivileged access to the leaking ioctl. In containerized or virtualized environments using macvtap for VM networking, restricting which guest VMs or container processes can access the host macvtap interface reduces exposure. Note that restricting macvtap access may impact VM network connectivity workflows and must be tested before deployment. No workaround fully mitigates the flaw in a running unpatched kernel for processes that legitimately require macvtap access.