Hacker News Reader

Because you shouldn't have to do mitigations for this level of severity while waiting weeks for OS patch. I did that, but now I'm waiting for patch to unwind my mitigations.

Because that doesn't allow for sensationalizing the frustration.

Agreed, it also wouldn't give free advertising to the OP author or to Anthropic who he gives a generous nod to.

Why do you ask such simple and obvious questions!? :-P

nft add table ip cve_2026_98432

nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }'

nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop

lol thank you friend :D

Talking of which, is there a link to the temporary fix?

`iptables -I INPUT 1 -m u32 --u32 '0>>24&0x0f=6:15' -j DROP`

(Taken from https://aws.amazon.com/security/security-bulletins/2026-160-...)

You can also use the following Suricata rule if your network firewall supports it:

`drop ip any any -> any any (msg:"CVE-2026-98432: drop IPv4 packets carrying IP options (IHL > 5)"; ipv4.hdr; bsize:>20; classtype:bad-unknown; sid:1000001; rev:2;)`