beyond the nft/iptables mitigations discussed codex plopped out a kernel livepatch for my ubuntu kernels in about twenty minutes. the functions are ftrace’able so no trampoline/splice shenanigans required.