===== Compilation =====

<code>

sysctl:
sudo sysctl -w net.mptcp.enabled=0
echo "net.mptcp.enabled=0" | sudo tee /etc/sysctl.d/99-disable-mptcp.conf
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo "kernel.unprivileged_userns_clone=0" | sudo tee /etc/sysctl.d/99-disable-userns.conf

fw:
sudo nft add table inet cve_2026_98432
sudo nft add chain inet cve_2026_98432 input { type filter hook input priority -310\; policy accept\; }
sudo nft add rule inet cve_2026_98432 input ip protocol tcp ip hdrlength > 5 counter drop comment \"CVE-2026-98432\"

</code>

===== CVE-2026-98432 =====

<code>

iptables -t raw -I PREROUTING -p tcp -m u32 --u32 "0>>24&0xF=6:15" -m comment --comment "CVE-2026-98432" -j DROP

ip protocol tcp ip hdrlength > 5 counter drop comment "CVE-2026-98432"

sudo sysctl -w net.mptcp.enabled=0

echo "net.mptcp.enabled=0" | sudo tee /etc/sysctl.d/99-disable-mptcp.conf

sudo ss -lnMp

</code>

===== CVE-2026-9999 =====

<code>

sudo sysctl -w kernel.unprivileged_userns_clone=0

</code>

===== CVE-2026-43284 / CVE-2026-46300 =====
<code>

echo -e "blacklist esp4\nblacklist esp6\nblacklist rxrpc\nblacklist ip6_tunnel" | sudo tee /etc/modprobe.d/disable-frag-CVEs.conf

</code>