Linux Kernel EUVD-2026-45650

Apply the vendor-released patch by upgrading to a fixed kernel: 6.18.34, 7.0.11, or 7.1, or the corresponding backported package from your distribution's security channel, which contain the two-stage ebtables removal fix (commits 739d5dac7b2da44a756aa4d758ee3f1ccf5a27f1, b7f0544d86d439cb946515d2ef6a0a75e8626710, ef395579a7631a06d61969fc712eb80402231b89 at git.kernel.org/stable). Where immediate patching is not possible, reduce exposure by restricting CAP_NET_ADMIN and unprivileged user-namespace creation (e.g. set kernel.unprivileged_userns_clone=0 or the equivalent sysctl/AppArmor control), since that is the capability needed to manipulate ebtables; the trade-off is that containers or tooling relying on unprivileged network-namespace configuration may break. If ebtables/bridge filtering is not used, blacklisting the ebtables and bridge netfilter modules removes the attack surface entirely, at the cost of losing layer-2 firewalling functionality. These are compensating controls only - schedule the kernel update as the durable fix.