Earlier quoted context omitted.
whoa, didn't expect a wall of text When I said about "no mitigations except for the kernel updates" I meant exactly that. Some sysctl config to flip, some kernel module to unload. Apparently such thing doesn't exist in this one
> The affected range is v2.6.39-rc1 to v7.1-rc1, with CONFIG_FUTEX_PI=y the only requirement and no capabilities or user namespaces needed.
See also https://nebusec.ai/research/ionstack-part-2/#mitigation for the fullpatch and two other mitigations