The bug is in skb_checksum_help(): an IPv4 packet with bad checksum metadata can corrupt the network header, according to patch author Michael S. Tsirkin. I am entirely guessing but the attack vector could be related to user namespaces. AV:L means it can’t be triggered over the network alone. The attacker needs code running on the box. PR:N means that code doesn’t need a real account. An unprivileged service user is enough. S:C means it crosses a security boundary, such as escaping a sandbox or container. So probably disabling user namespaces could be a preventative step, maybe. There should be kernel updates available to each distro as soon as the recent upstream build gets through the build/review process in each distro either way.
Look for anything using user namespaces before disabling on servers. Do not disable on workstations/laptops as many apps use user namespaces. Test on servers with an ephemeral setting before touching sysctl.conf.
r=$(readlink /proc/1/ns/user); for p in /proc/[0-9]*; do u=$(readlink $p/ns/user 2>/dev/null) || continue; [ "$u" = "$r" ] || echo "${p#/proc/} $(cat $p/comm 2>/dev/null)"; done
# in dev/qa, not on laptop.
sysctl -w user.max_user_namespaces=0
# restart all applications and test, full regression