Linux Kernel EUVD-2026-38823

Apply your distribution's kernel update that includes this fix; the upstream patched versions are 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, and mainline 7.1 (Vendor-released patch confirmed via the kernel.org stable commits, e.g. https://git.kernel.org/stable/c/6e70ef53e818c53eab28d7b0026b7fd03dddaba5). Choose the patched release matching your stable series and reboot, or use livepatch if your vendor ships one. Where immediate patching is not possible, the practical compensating control is to ensure kernel Ceph clients only connect to trusted clusters and to harden that trust boundary: enable Ceph cephx authentication and require-signatures (cephx_require_signatures / cephx_cluster_require_signatures) so clients reject spoofed monitor/OSD traffic, and use network segmentation or firewall rules to restrict the Ceph monitor/OSD ports (typically 6789/3300 for monitors and 6800-7300 for OSDs) to known cluster hosts only, blocking MITM injection of malicious OSD maps. If a host does not require kernel RBD/CephFS, unload the ceph/rbd/libceph modules (or avoid loading them) to remove the attack surface entirely; the trade-off is loss of in-kernel Ceph mounts, so this suits hosts that use userspace librbd/Ceph-FUSE or no Ceph at all. Validate fixes against https://nvd.nist.gov/vuln/detail/CVE-2026-52955.