Linux Kernel EUVD-2026-38852

Apply the vendor-released stable kernel update for the branch in use: upgrade to Linux 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 as appropriate. Commit-level patches for each branch are indexed at https://git.kernel.org/stable/c/ via the cveorg references above. For systems unable to patch immediately, the most effective compensating control is to ensure no netem qdisc with reordering is configured in production - removing or not deploying the netem qdisc entirely eliminates the vulnerable code path without side effects on non-test workloads. A second control is to restrict CAP_NET_ADMIN capability so that only root can configure traffic control (e.g., disabling unprivileged user namespaces via kernel.unprivileged_userns_clone=0 on affected distros), which prevents low-privilege users from creating or modifying qdiscs; note this may break container networking features that rely on user namespaces. Neither workaround substitutes for patching on systems where netem is legitimately required.