[Unit]
Description=CVE-2026-98432 interim mitigation (drop IPv4 TCP with IP options)
DefaultDependencies=no
After=nftables.service
Before=network-pre.target
Wants=network-pre.target

[Service]
Type=oneshot
ExecStart=/usr/sbin/nft -f /etc/nftables-cve98432.nft
ExecStop=-/usr/sbin/nft delete table inet cve98432
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target