Handling a Linux kernel CVE across a fleet: exposure check, mitigation, livepatch, reboot
A kernel CVE lands and someone asks whether we are affected. Using CVE-2025-21756 in vsock as the worked example, this is our playbook: find which hosts are exposed, mitigate where the module is unused, livepatch where possible, and schedule reboots without drama.
