A CVE-2026-98432 firewall rule for Ubuntu, with or without Docker

PhotoStructure published a temporary nftables mitigation for CVE-2026-98432, a kernel use-after-free involving IPv4 TCP packets with IP options, which Ubuntu rates High; its 26.04 fix was still in progress as of November 1. The author says Red Hat's input-hook rule and a UFW one-liner miss traffic forwarded to Docker bridge containers, while a prerouting and output table catches it. Testing covered only Ubuntu 26.04, verified packet filtering rather than exploit resistance, and the rule needs Ubuntu 24.04 or later. It does not replace a patched kernel.