Go 1.24 MPTCP default exposes servers to Linux kernel RCE (CVE-2026-98432)
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
The Go security team says CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP handshake path (CVSS 9.8), matters for Go servers because Go 1.24 enables MPTCP on Linux listen sockets by default. Anthropic's demonstrated remote code execution used an MPTCP listener in a lab, though the team says the bug is not MPTCP-specific. Fixed kernels, such as 6.12.113 and 6.18.56, are the recommended remedy. Setting GODEBUG=multipathtcp=0 is called a fragile mitigation, and Go is not changing its default for now.