Hm. mijn eerdere posting was niet juist. https://ubuntu.com/blog/fixes-available-in-proposed-pocket-for-cve-2026-98432 benoemt geen mitigations, maar https://ubuntu.com/security/CVE-2026-98432 geeft option filtering wel als mitigation. cengizcan> IPv4 TCP packet filtering: - Requires: nftables and root access through sudo. - Assumes: IPv4 options are not needed. For boot persistence, /etc/nftables.conf manages the firewall, without UFW or firewalld. - Blocks: incoming IPv4 TCP packets that contain IP options. - Keeps working: IPv4 TCP connections without IP options. TCP options such as timestamps and window scaling are unaffected, as is IPv6. Existing firewall rules still apply. - Breaks: TCP connections that depend on IPv4 options. - Covers: the host, including connections from the host to itself. Containers with separate networking need the rule applied separately. - Limit: reduces the risk but does not fully prevent exploitation. To apply the rule: 1. Create the rule file: printf ‘%s\n’ ‘table ...