Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Kernel TCP flaw CVE-2026-98432 draws Go advice and Linode response

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CVE-2026-98432, a Linux kernel TCP use-after-free with a described RCE path, has Go urging patched kernels while Linode mitigates.

The Go Security Team said CVE-2026-98432 is a use-after-free in Linux kernel IPv4 TCP connection handling. An exploit described by Anthropic shows remote code execution against a server with a Multipath TCP listener, and the team says the bug is not limited to MPTCP. Go has enabled MPTCP by default for Linux listen sockets since Go 1.24; it recommends a patched kernel, calls per-program disabling fragile, and does not plan an immediate default change. Akamai said it is investigating the flaw in connection with Linode, taking mitigation actions and monitoring the platform, with no confirmed compromise stated. Customers who see impact are told to open a support ticket.

Key facts
  • CVE-2026-98432 is a Linux kernel IPv4 TCP use-after-free, the Go Security Team said.
  • Go has enabled MPTCP by default for Linux listen sockets since Go 1.24.
  • GODEBUG=multipathtcp=0 or godebug multipathtcp=0 can disable MPTCP; Dialer and ListenConfig can override it.
  • Leaving one MPTCP listener exposed can still leave a system vulnerable, Go said.
  • Linode's first status note on October 30 at 18:10 UTC said mitigation was underway.
  • A 21:18 UTC update said the investigation continued; no compromise was confirmed.
Analyze CVE-2026-98432 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 30, 2026Akamai posts Linode status: mitigation underway · Hacker News
  2. Oct 30, 2026Follow-up says investigation and mitigation continue · Hacker News

What each outlet adds

beyond the shared facts
  • LobstersGo MPTCP defaults, disable flags, and issue 82717
  • Hacker NewsLinode status times, ongoing mitigation, and support path
CVEs
CVE-2026-98432
Vendors
Akamai
Products
Linux kernelGoLinode
Organizations
Go Security TeamAnthropic

Coverage

oldest first · one row per article · UTC
  1. · 7h ago Lobsters · securityFirst report

    Go team warns CVE-2026-98432 can give RCE via MPTCP

    Since Go 1.24, Linux listen sockets enable MPTCP by default; turning it off is only a fragile stopgap.

  2. · 3h ago Hacker News · security

    Akamai investigates Linode exposure to RCE CVE-2026-98432

    The status page says mitigation is underway and the platform is being monitored, with no confirmed compromise.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-98432
Use-after-free in Linux kernel IPv4 TCP options
9.8<1%PoC ×17