• https://access.redhat.com/security/vulnerabilities/RHSB-2026-016
    • Save the following to a file named cve-2026-98432.nft: 
      table inet cve_2026_98432 {
    chain input {
        type filter hook input priority -310; policy accept;
        ip protocol tcp ip hdrlength > 5 counter drop
    }
}
    • Validate and apply the rule: 
      sudo nft --check --file cve-2026-98432.nft
sudo nft --file cve-2026-98432.nft
sudo nft list table inet cve_2026_98432
    • Removal 
      After the kernel has been updated to a fixed version, remove the mitigation rule:
sudo nft delete table inet cve_2026_98432