Comment by tptacek

Dropping packets with IP options from XDP should be a more complete mitigation (also more performant).