I get the frustration, but isn't there an iptables rule that is a viable mitigation? Why not deploy that first?

Because that doesn't allow for sensationalizing the frustration.

	▲	newsoftheday 4 hours ago \| parent [-]
		Agreed, it also wouldn't give free advertising to the OP author or to Anthropic who he gives a generous nod to.

▲

Aldipower an hour ago | parent | prev | next [-]

Why do you ask such simple and obvious questions!? :-P

nft add table ip cve_2026_98432

nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }'

nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop

▲

lekevicius 4 hours ago | parent | prev | next [-]

Because you shouldn't have to do mitigations for this level of severity while waiting weeks for OS patch. I did that, but now I'm waiting for patch to unwind my mitigations.

▲

callamdelaney 4 hours ago | parent | prev | next [-]

Talking of which, is there a link to the temporary fix?

	▲	otterley 4 hours ago \| parent [-]
		`iptables -I INPUT 1 -m u32 --u32 '0>>24&0x0f=6:15' -j DROP` (Taken from https://aws.amazon.com/security/security-bulletins/2026-160-...) You can also use the following Suricata rule if your network firewall supports it: `drop ip any any -> any any (msg:"CVE-2026-98432: drop IPv4 packets carrying IP options (IHL > 5)"; ipv4.hdr; bsize:>20; classtype:bad-unknown; sid:1000001; rev:2;)`

▲

Shank 2 hours ago | parent | prev [-]

[dead]