Linux Kernel EUVD-2026-55547

Upstream fix available and released in stable kernels - update to at least 6.6.151, 6.12.101, 6.18.42, or 7.1.6 (fix present in 7.2-rc5), matching your kernel branch; apply the distribution kernel package that incorporates the corresponding kernel.org commit (e.g. c6eb2d615210..., see https://git.kernel.org/stable/c/c6eb2d615210b80339548ab07c0230edaab9a6c7). As a compensating control until patched, avoid enabling SCTP UDP tunneling by leaving net.sctp.udp_port at 0 (the default), which prevents the per-net tunnel sockets from ever being created and thus avoids the teardown race - side effect: SCTP-over-UDP encapsulation will not function. Where SCTP itself is unneeded, blacklist the sctp module (e.g. install sctp /bin/true), which removes the attack surface entirely at the cost of disabling SCTP. On multi-tenant/container hosts, restrict unprivileged user-namespace creation (e.g. sysctl kernel.unprivileged_userns_clone=0 where available) to deny untrusted users the CAP_NET_ADMIN needed to set the sysctl, noting this may break sandboxes and container runtimes that rely on user namespaces.