Linux Kernel EUVD-2026-59246

The primary remediation is upgrading to a patched kernel version: 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc3, depending on the active stable branch. Upstream fix commits are indexed at https://git.kernel.org/stable/c/ for each stable tree. For systems where immediate kernel upgrade is not feasible, a targeted compensating control is to unload or blacklist the xt_connmark kernel module (modprobe -r xt_connmark; echo 'blacklist xt_connmark' >> /etc/modprobe.d/blacklist.conf) - this prevents the vulnerable code from being loaded entirely, though it will break any existing iptables/nftables rules that use the CONNMARK target. A second compensating control applicable to multi-tenant environments is disabling unprivileged user namespaces via sysctl -w kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or kernel.userns_restrict=1 where supported; this raises the effective privilege bar for rule installation back to root, though it may break container runtimes (e.g., rootless Podman, unprivileged LXC) that rely on user namespaces. Audit existing iptables/nftables ruleset for CONNMARK revision 2 rules with shift_bits >= 32 using iptables-save | grep CONNMARK.