Depends on which box you are on. If it is umbrelOS: on the x86 units the kernel update is the whole answer, reboot and check uname -r. On a Pi you get whatever that OS release ships, the blocking is done for you and there is nothing to add by hand. Anywhere else, two steps. 1. Find out whether you already have it. The upstream fix is small, kfree becomes kfree_rcu in inet_sock_destruct() and tcp_v4_reqsk_destructor(), and it landed in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10. Debian 12 is 6.1.190-1, Debian 13 is 6.12.113-1. Ubuntu 22.04, 24.04, 26.04 and 26.10 were still open on Oct 30, as were RHEL 8 to 10. 2. If your kernel is older, cut the reachable path. The freed object only exists when a SYN carries IPv4 options, so drop those before the TCP stack parses them: nft add table inet cve98432 nft add chain inet cve98432 prerouting "{ type filter hook prerouting priority -300; policy accept; }" nft add rule inet cve98432 prerouting ip hdrlength gt 5 meta l4proto tcp counter drop That is the rule CIQ tested on Rocky 8, 9 and 10. Put it in its own table so a firewalld reload does not wipe it, and give it a oneshot systemd unit that loads the file at boot, otherwise it is gone at the next reboot, which is the part people skip. It also drops legitimate traffic that carries Record Route or Timestamp, so try it on one host before you roll it out. And skip net.mptcp.enabled=0 as the mitigation. On their test kernels it read back as 0 and a plain TCP listener still answered a SYN carrying a Record Route option and echoed it back, so the path stays open. Turning MPTCP off only removes the version of the attack Anthropic demonstrated.