Go programs on Linux listen with Multipath TCP by default, exposing servers to the remote-root kernel bug CVE-2026-98432 (Ubuntu and RHEL fixes still pending)

CVE-2026-98432 is a race-condition use-after-free in the Linux kernel's IPv4 TCP connection setup (kernel CNA CVSS 9.8; distros score 5.9-8.1). On Oct 27 Anthropic said its model built a zero-click exploit that lets an unauthenticated remote attacker run commands as root on servers with a Multipath TCP (MPTCP) listener. Since Go 1.24, Go programs open MPTCP listening sockets by default on Linux, so any unpatched Linux host running a Go network service (web servers, APIs, proxies, agents) meets the condition from that exploit. The Go security team confirmed this on Oct 30 and said the bug is not specific to MPTCP, so hosts without MPTCP listeners may also be at risk. Upstream fix landed Oct 5 and has been backported to stable branches (CVE published Oct 15), but as of Oct 29 Ubuntu and RHEL had no fixed kernel. No in-the-wild exploitation reported; exploit code is not public.

Summary written from the sources below. Check the originals before acting.