Comment by cft

2 hours ago

Do

sudo tcpdump --immediate-mode -p -nn -i eth0 -vvv -c 1 'ip and (ip[0] & 0x0f > 5)'

to see if you even get them from upstream.

You can even ping it from outside with these packets in the meantime

ping -R -c 3 $IP

1 comment

cft

Reply
Bender  1 hour ago

One can also monitor for it in nftables. This is from my raw table:

    grep CVE /etc/nftables.nft
    # Options CVE
    iifname "eth0" ip daddr $ADDR4 meta l4proto tcp ip hdrlength gt 5 counter log prefix "CVE-2026-98432: " level debug

Once confident nothing legit would be blocked by dropping the packets one can change "log prefix "CVE-2026-98432: " level debug" to "drop" if on an unpatched kernel.

$ADDR4 in my case in my internet facing interface.