I haven't had a documented packet with IPOptions arrive on any of my firewalls, the packets are typically dropped, so exploiting remotely is going to be very difficult. In theory you could use another exploit and then lateral move in some networks which don't drop them at a router level.

Here’s the real answer. It’s not as scary as the original reporters made it out to be.

Then why is it rated 9.8? (Including by Ubuntu itself)

Because the rating system is not very good.

It’s not by RedHat. Does Ubuntu provide its own independent research and scoring?

RedHat's web site shows it as a 9.8 at https://access.redhat.com/security/cve/cve-2026-98432. Now, there may be times when Redhat downgrades a score...say for example you have SELinux and the vulnerability is blocked by it but they usually track with the official number.

Yeah, had this ever actually been proven in the "real world"?

Does it have to be? I am betting there's more people working on proving this and not disclose the proof than to do.

It doesn't have to be, but it's getting a bit weird that everytime this subject comes up nobody has an actual example.

See here: https://x.com/mattiasgeniar/status/2118040483154755627

tldr: DoS and not RCE