Dropping packets with IP options from XDP should be a more complete mitigation (also more performant).
https://en.wikipedia.org/wiki/Express_Data_Path for anyone else wondering what that is
https://en.wikipedia.org/wiki/Express_Data_Path for anyone else wondering what that is