Go 1.24 MPTCP default exposes servers to Linux kernel RCE (CVE-2026-98432)
Comments on “Go 1.24 MPTCP default exposes servers to Linux kernel RCE (CVE-2026-98432)”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
The Go security team says CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP handshake path (CVSS 9.8), matters for Go servers because Go 1.24 enables MPTCP on Linux listen sockets by default. Anthropic's demonstrated remote code execution used an MPTCP listener in a lab, though the team says the bug is not MPTCP-specific. Fixed kernels, such as 6.12.113 and 6.18.56, are the recommended remedy. Setting GODEBUG=multipathtcp=0 is called a fragile mitigation, and Go is not changing its default for now.
Why it ranked
No. 13 of 111 with a score of 0.73. The panel rated it highest on practical relevance (0.89) and reader interest (0.86), lowest on substantiated (0.64). Overclaim counted against it (0.57). The judges disagreed most on overclaim (spread 0.57), so the story is marked contested. Placed No. 13, No. 10 by score alone: the sixth Security story of the day (−0.060). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Mailing-list forward of a Go security advisory about a Linux kernel RCE and MPTCP default mitigations; highly relevant to builders, actionable, but thin on technical detail and mostly relays others' disclosures.
- AI judgeJudge 3gpt-5.6-luna
- A primary security-team advisory connects a serious Linux kernel RCE to Go 1.24’s MPTCP default and gives concrete mitigations. The headline overstates certainty because exploitation is demonstrated for MPTCP and broader exposure remains conditional.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.73total under rubric v2.3Contestedjudges differ by 0.57 on overclaim
- Significance0.75
- Reader interest0.86
- Audience breadth0.72
- Practical relevance0.89
- Substantiated0.64
- Technical depth0.65
- New information0.82
- Counts against: Promotional0.05
- Counts against: Overclaim0.57
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.67 | 0.80 | 0.78 | 0.75 | 0.14 | +0.24 | +0.180 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.74 | 0.90 | 0.94 | 0.86 | 0.20 | +0.26 | +0.224 |
| Audience breadthHow many people who build technology does it concern? | 0.66 | 0.85 | 0.64 | 0.72 | 0.21 | +0.13 | +0.093 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.89 | 0.90 | 0.88 | 0.89 | 0.02 | +0.22 | +0.196 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.59 | 0.50 | 0.82 | 0.64 | 0.32 | +0.05 | +0.032 |
| Technical depthHow technically substantive is it? | 0.74 | 0.50 | 0.72 | 0.65 | 0.24 | +0.05 | +0.033 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.87 | 0.60 | 0.98 | 0.82 | 0.38 | +0.05 | +0.041 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.12 | 0.02 | 0.01 | 0.05 | 0.11 | −0.19 | −0.010 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.64 | 0.25 | 0.82 | 0.57 | 0.57 , above the contested threshold | −0.11 | −0.063 |
| Sum of contributions | +0.725 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.726 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-31/13/"><img src="https://rubric.hrih.si/badge/2026-10-31/13.svg" alt="Ranked #13 on Rubric, 31 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 4 matches source · 1 no source given · 1 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkNumber
CVE-2026-98432 is a use-after-free issue affecting IPv4 TCP connection handling in the Linux kernel.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “describes a use-after-free issue which impacts IPv4 TCP connection handling in the Linux kernel”
The source says No passage could be compared.
Source cited by the article: nvd.nist.gov/vuln/detail/cve-2026-98432
Matches sourceCausal conclusion
An exploit described by Anthropic shows a server using Multipath TCP (MPTCP) listeners is vulnerable to Remote Code Execution.
The cited source says the same thing.
The article says “a server using Multipath TCP <https://en.wikipedia.org/wiki/Multipath_TCP> (MPTCP) listeners is shown to be vulnerable to Remote Code Execution (RCE”
The source says “Claude wrote an exploit that allows a remote attacker to send packets to Linux servers with a multipath TCP listener to run arbitrary commands as root, without any credentials or…”
Source cited by the article: anthropic.com/research/discovering-vulnerabilities-with-claude
Matches sourceVersion
As of Go 1.24, Go programs enable MPTCP by default for listen sockets on Linux.
The cited source says the same thing.
The article says “As of Go 1.24 <https://go.dev/doc/godebug#go-124>, Go programs enable MPTCP by default for listen sockets on Linux”
The source says “For Go 1.24, it now defaults to multipathtcp=“2”, thus enabled by default on listeners”
Source cited by the article: go.dev/doc/godebug
Matches sourceNumber
Setting GODEBUG=multipathtcp=0 in a program's environment disables MPTCP by default at runtime.
The cited source says the same thing.
The article says “Setting "GODEBUG=multipathtcp=0" in a program's environment will disable MPTCP by default at runtime”
The source says “Using multipathtcp=“0” reverts to the pre-Go 1.24 behavior”
Source cited by the article: go.dev/doc/godebug
Matches sourceNumber
Per-socket calls to net.Dialer.SetMultipathTCP and net.ListenConfig.SetMultipathTCP override the GODEBUG setting.
The cited source says the same thing.
The article says “These functions override the GODEBUG setting”
The source says “This method overrides the system default and the GODEBUG=multipathtcp=... setting if any”
Source cited by the article: pkg.go.dev/net
No source givenGeneralization
The underlying bug is not specific to MPTCP, so systems with no MPTCP listeners may be vulnerable to similar attacks.
The article gives no link or citation for it.
The article says “the underlying bug is not specific to MPTCP. It is possible that systems with no MPTCP listeners are vulnerable to similar attacks”
The source says No source to compare with.
Also covered by
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 31 Oct 2026, 05:46 UTC. It played no part in the ranking.