you do know you can just put a firewall rule in to prevent any IP options from hitting the server The rule (matches header length > 20 bytes, i.e. IHL 6–15): iptables -I INPUT 1 -m u32 --u32 "0>>24&0x0F=6:15" -m comment --comment ipopts-stopgap -j DROP ufw: add -A ufw-before-input -m u32 --u32 "0>>24&0x0F=6:15" -j DROP to /etc/ufw/before.rules, above the RELATED,ESTABLISHED accept line. Then run ufw reload. csf: put the iptables line in /usr/local/csf/bin/csfpre.sh so it survives csf restarts. Docker hosts: use -t raw -I PREROUTING instead, so container traffic is covered too. Test: run ping -R at the box and watch the counter go up in iptables -L INPUT -v -n. Note that many networks drop option packets in transit, so test from the same LAN or a local netns. its a stopgap. not a fix. but you don't have to take all your servers offline ..... just put the block in and wait for the patch