Is step 3 reading the CVE for long enough to understand that disabling mptcp is an incomplete mitigation? What happens if someone discovers a bug in the particular firewall software you're running?