Linux Kernel EUVD-2026-38945

Apply the vendor kernel update for your stable series - Vendor-released patch: upgrade to 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, or 7.0.10/7.1 or later as appropriate for your tree (commits at https://git.kernel.org/stable/c/fb407343c0c16e94584707b2dfdd350a5f81b000 and the related stable hashes such as https://git.kernel.org/stable/c/c244b79adffad89a5173cf8bfaa06a6b40bbd09b). Until you can reboot into a patched kernel, the most effective compensating control is to prevent RDS from loading where it is not needed: blacklist the rds, rds_rdma, and rds_tcp modules via modprobe (e.g. install rds /bin/true), which fully removes the attack surface but breaks any workload that relies on RDS messaging. Where RDS is required, restrict unprivileged network-namespace creation (sysctl kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0) so untrusted local users and containers cannot exercise RDS/IB outside the initial netns; the trade-off is that this also disables legitimate unprivileged container/sandbox features. Confirm exact fixed versions against your distribution's advisory before relying on a specific build.