Dropping packets with IP options from XDP should be a more complete mitigation (also more performant).