Add the below rule onto your machine's /etc/ufw/before.rules to mitigate it.

    # CVE-2026-98432 mitigation: drop TCP packets carrying IPv4 extended options
    -A ufw-before-input -p tcp -m u32 --u32 "0>>24&0xF=6:15" -j DROP

Any value >5 in this field means ip extended header options and so values of 6 through 15 should be dropped. Note that I don't just drop syn packets like the mptcp exploit because any tcp packet could do it in theory.

This works for me on multiple servers and home desktops and my hardware linux firewall/router. I did it a couple days ago when this was first announced. The iptables counter for matches haven't gone up at all on my VPS servers that gets lots of traffic. The counter only goes up when I manually trigger it to test. Everything continues to work nominally with these in place.