so just block multipath and add the firewall rule from article that drops packets with IPv4 options
Both of which we are finding out are apparently insufficient to mitigate this.
"the bug sits in code every Linux server runs when it accepts an IPv4 TCP connection, before any application sees the connection."
Is iptables considered an "application" here? I.e. can this bug be triggered before iptables drops the packet?
loading story #50323362
Hoping fix will be out soon so we don’t have to.