Linux Kernel EUVD-2026-49028

Upgrade to a patched stable kernel: 5.10.261+, 5.15.212+, 6.1.178+, 6.6.145+, 6.12.96+, 6.18.39+, or 7.1.4+, as confirmed by the upstream stable commits at git.kernel.org/stable/c/45c0e3615e5bca5f1fc93357af8d19975c092d4f and related references in the EUVD advisory. For embedded platforms where a full kernel upgrade is not immediately feasible, the most direct compensating control is to restrict kernel ring buffer access via sysctl: set kernel.dmesg_restrict=1, which prevents non-privileged users from reading dmesg output (side effect: may impair non-root diagnostic tooling). A second option is to suppress caam debug output at runtime without rebooting by disabling it via the dynamic debug interface: echo 'module caam -p' > /sys/kernel/debug/dynamic_debug/control - this prevents the dumps from appearing without a kernel rebuild. For new builds, disabling CONFIG_DYNAMIC_DEBUG at compile time eliminates the exposure entirely. Rotating any cryptographic keys that may have been exposed during the vulnerable window is advisable on systems where dmesg logs could have been accessed.