Linux Kernel EUVD-2026-39309

Upgrade to one of the vendor-released patched kernel stable branches: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1. Fix commits are available at git.kernel.org/stable for each respective branch. Distribution maintainers for RHEL, Ubuntu, Debian, and SUSE typically backport these stable patches - consult your distribution's security advisory channel for packaged updates. Where immediate patching is not feasible, restrict access to nftables rule configuration by auditing and removing CAP_NET_ADMIN grants from unprivileged users, service accounts, and container workloads that do not require it; be aware that revoking CAP_NET_ADMIN from container runtimes (e.g., Docker, Podman) or network management daemons may break legitimate network configuration functionality. User namespace-enabled environments should be reviewed particularly carefully, as they may grant CAP_NET_ADMIN within a namespace to otherwise low-privilege users.