One can also monitor for it in nftables. This is from my raw table:

    grep CVE /etc/nftables.nft
    # Options CVE
    iifname "eth0" ip daddr $ADDR4 meta l4proto tcp ip hdrlength gt 5 counter log prefix "CVE-2026-98432: " level debug

Once confident nothing legit would be blocked by dropping the packets one can change "log prefix "CVE-2026-98432: " level debug" to "drop" if on an unpatched kernel.

$ADDR4 in my case in my internet facing interface.