If you're running a recent version of Geth, time to upgrade it. And run a couple mitigations... > Since Go 1.24, Go programs open MPTCP listeners by default. A running geth would likely put an MPTCP listener on 30303, which the firewall leaves open to the internet. That is exactly the setup the working exploit needs. I’m inferring this from the Go default; I haven’t checked it on a running geth. Interim mitigations until Ubuntu ships a fixed kernel: Turn MPTCP off (net.mptcp.enabled=0). This removes the setup the exploit needs. Add a firewall rule that drops incoming TCP packets carrying IPv4 options. Red Hat says this “reduces exposure… but cannot fully prevent it”.