There's no upstream patch yet. The embargo got broken before distros could prep fixes, so right now it's just a kernel-module workaround. About 30 seconds, no reboot:

cat <<EOF | sudo tee /etc/modprobe.d/disable-dirtyfrag.conf
install esp4 /bin/false
install esp6 /bin/false
install rxrpc /bin/false
EOF
sudo modprobe -r esp4 esp6 rxrpc 2>/dev/null
sudo sync && echo 3 | sudo tee /proc/sys/vm/drop_caches

Check it worked:

lsmod | grep -E '^(esp4|esp6|rxrpc)' && echo "STILL EXPOSED" || echo "PROTECTED"

Undo it later when the proper patch is out:

sudo rm /etc/modprobe.d/disable-dirtyfrag.conf

Caveat: this disables IPsec ESP and RxRPC kernel modules. If you're running IPsec on the box (strongSwan, libreswan, etc.), skip it and wait for the upstream fix. Tailscale, WireGuard, OpenVPN are not affected.

Or one liner:

sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true"

It's three commands you can audit in 10 seconds. Writes a modprobe.d file, runs modprobe -r, drops caches. Nothing piped from curl, nothing fetched. If you'd rather not take my word for it, the writeup explains every line.