Ubuntu still lists CVE-2026-98432 as vulnerable on Noble on 2026-11-04: https://ubuntu.com/security/CVE-2026-98432. MPTCP stays disabled; disabling it alone does not eliminate this TCP race.

The dedicated nftables table drops IPv4 TCP packets carrying IP options. Ordinary TCP options (timestamps, window scaling), IPv6, and existing firewall policy are unaffected. Connections requiring IPv4 options will fail. This is risk reduction, not a substitute for the fixed kernel.

The prerouting hook covers external traffic before Docker DNAT/forwarding; the output hook also covers host-originated traffic. Separate container network namespaces can still generate internal traffic outside these hooks. Do not claim protection against untrusted local/container workloads.

Install the nft file as /etc/stream-tcp-options-guard.nft and the unit in /etc/systemd/system/. Run nft -c -f /etc/stream-tcp-options-guard.nft, then systemctl daemon-reload and systemctl enable --now stream-tcp-options-guard. The unit owns only its named table. Do not enable the default nftables service or flush the ruleset: Docker owns other tables.

Verify with nft list table inet stream_tcp_options_guard, a fresh SSH session, HTTPS health/status checks, and advancing upstream sequences. Roll back with systemctl disable --now stream-tcp-options-guard. Keep the mitigation until a fixed Ubuntu kernel is available, installed, booted, and verified with uname -r.

MPTCP namespaces #

net.mptcp.enabled is per network namespace. Verify it inside each container; the host value alone does not prove container state. Include deploy/security/compose.mptcp.yaml in the deployment's COMPOSE_FILE list so both Stream and Caddy keep MPTCP disabled after recreation.

For a running container, its namespace can be updated without a restart:

stream_pid=$(docker inspect stream-experiment-stream-1 --format '{{.State.Pid}}')
nsenter -t "$stream_pid" -n sysctl -w net.mptcp.enabled=0
docker exec stream-experiment-stream-1 cat /proc/sys/net/mptcp/enabled

This is an additional reduction in exposure, not a replacement for the filter or the patched kernel. The host's /etc/sysctl.d/99-disable-mptcp.conf remains in place as well.