EDIT: do not panic as much, nvm, this is in `recvmmsg` not `recvmsg`, which is not used by much software. Definitely not sshd or nginx. I can't find any software I have installed that does.

I think the best advice is not to listen to anyone on HN about this shit except for cperciva

Original response:

----

Reimage everything from scratch if you're a bit paranoid, because in theory someone could have rooted every server running any internet-accessible thing (even just sshd or nginx)

Realistically, update ASAP and figure out from other sources how difficult this is to exploit and how likely it is that anyone actually did get a working RCE

Delpoyed boxes: ksplice / kpatch or run updates when available.

And consider mitigations at various tech stack layers.

I haven't found a way to patch a kernel with nontrivial modules without kernel restart. This makes the mechanism only useful to reduce system reboot times after a patch.