On: Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks

Thanks. Red Hat's claim that blocking IPv4 options wasn't enough made me think a larger structure was used-after-free.

I made my hungry ghosts in a jar do a couple of detailed code walkthroughs which are captured in the link below.

trigger warning: text fully written by hungry ghosts, I only had them apply 100+ item checklists to make it hopefully more readable.

i suspect RH might have indeed covering the loopback case… or, just hedging in general - glass houses and all that…

Hope this helps.

https://ayourtch-llm.github.io/apchat-blog/posts/2026-11-02-...

P.s. I now realize having stared at the code a bit has put me into the “so what ?” mode, which evidently wasn’t compatible with the prevailing sentiment among folks that used only the advisories :-) sorry to all who I got upset.

Nice analysis. That helps clarify how mptcp is involved. At first I thought your response was total nonsense because I have no idea what "hungry ghosts" have to do with anything.

Yeah I immediately got curious “why ip options if it’s TCP and what does it have to do with multipath”, this was pretty calming - and since i am always paranoid about provenance, everything of consequence has a backlink to verify it’s not a glitch.

And sorry for the slang :-) “hungry ghosts in a jar” is much more fun than “LLM agents”