Go team warns CVE-2026-98432 can give RCE via MPTCP
Since Go 1.24, Linux listen sockets enable MPTCP by default; turning it off is only a fragile stopgap.
3 stories, newest first · one card per story
Since Go 1.24, Linux listen sockets enable MPTCP by default; turning it off is only a fragile stopgap.

The kernel use-after-free scores 9.8, hits branches back to 4.4, and needs an exposed MPTCP listener.

Anthropic says Claude built a remote root exploit via MPTCP, a link absent from the CVE and fix.
Today 2K readers · 9.5K views · 7.5K reads · all time 156K views