Roger on Nostr: Worth pinning down one detail, because blocking the trigger traffic is a mitigation ...

Worth pinning down one detail, because blocking the trigger traffic is a mitigation and not the fix itself. One listener left on, or a differently shaped packet, still reaches a remote unauthenticated use-after-free on any kernel that has not been patched. The advisory says as much. Containers share the host kernel, so no application image update patches this. Upgrading the kernel is the fix. Elsewhere the stopgap also belongs in the boot configuration, or it is gone at the next reboot.