Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

Go team warns CVE-2026-98432 can give RCE via MPTCP

Original title: Protecting against CVE-2026-98432

Lobsters · securityby groups.google.com via func25 ()1 min read1
Read at groups.google.com
AI summary · x-ai/grok-4.7Summaries by Vani AI

Since Go 1.24, Linux listen sockets enable MPTCP by default; turning it off is only a fragile stopgap.

The Go Security Team said CVE-2026-98432 is a use-after-free in Linux kernel IPv4 TCP connection handling. An exploit described by Anthropic shows remote code execution against a server with a Multipath TCP listener, and the team says the bug is not limited to MPTCP. Go has enabled MPTCP by default for Linux listen sockets since Go 1.24. The recommended fix is a patched kernel; per-program MPTCP disabling is described as fragile, and Go does not plan an immediate default change.

Unconfirmed: The Go team says non-MPTCP systems might also be vulnerable, but that is not demonstrated.

Key facts
  • Set GODEBUG=multipathtcp=0 at runtime or godebug multipathtcp=0 in go.mod to disable MPTCP by default.
  • net.Dialer.SetMultipathTCP and net.ListenConfig.SetMultipathTCP override that GODEBUG setting.
  • Further Go discussion is tracked at go.dev/issue/82717.
  • Leaving one MPTCP listener exposed can still leave a system vulnerable.
Security assessment · AI, from the articlePublic proof of concept

Impact: Remote code execution against exposed TCP listeners

ProductAffected
Linux kernel—
GoGo 1.24 and later on Linux, MPTCP enabled by default for listen sockets
What to do
  1. 1.Upgrade to a patched Linux kernel version.
  2. 2.Disable default MPTCP with GODEBUG=multipathtcp=0 or godebug multipathtcp=0 as a fragile mitigation.
Analyze CVE-2026-98432 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-98432
ATT&CK
T1190 Exploit Public-Facing Application
Tags
linux-kernelmptcpgolanguse-after-freerce
Products
Linux kernelGo
Organizations
Go Security TeamAnthropic

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-98432
Use-after-free in Linux kernel IPv4 TCP options
9.8<1%PoC ×15

From the original article

1 min read at groups.google.com

The recent disclosure of CVE-2026-98432 describes a use-after-free issue which impacts IPv4 TCP connection handling in the Linux kernel. In an exploit described by Anthropic , a server using Multipath TCP (MPTCP) listeners is shown to be vulnerable to Remote Code Execution (RCE). The best fix for this vulnerability is to upgrade to a patched kernel version.

Lobsters · security

By groups.google.com via func25 · groups.google.com

Read the full article at Lobsters · security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.