{"id":"TECH-202610-go-programs-on-linux-listen-with-multipath-tcp-by-default-ex","kind":"technique","aliases":[],"related":[],"title":"Go programs on Linux listen with Multipath TCP by default, exposing servers to the remote-root kernel bug CVE-2026-98432 (Ubuntu and RHEL fixes still pending)","description":null,"summary":"CVE-2026-98432 is a race-condition use-after-free in the Linux kernel's IPv4 TCP connection setup (kernel CNA CVSS 9.8; distros score 5.9-8.1). On Oct 27 Anthropic said its model built a zero-click exploit that lets an unauthenticated remote attacker run commands as root on servers with a Multipath TCP (MPTCP) listener. Since Go 1.24, Go programs open MPTCP listening sockets by default on Linux, so any unpatched Linux host running a Go network service (web servers, APIs, proxies, agents) meets the condition from that exploit. The Go security team confirmed this on Oct 30 and said the bug is not specific to MPTCP, so hosts without MPTCP listeners may also be at risk. Upstream fix landed Oct 5 and has been backported to stable branches (CVE published Oct 15), but as of Oct 29 Ubuntu and RHEL had no fixed kernel. No in-the-wild exploitation reported; exploit code is not public.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Linux kernel","fixed":[],"ecosystem":"linux"},{"name":"Go","fixed":[],"versions":">=1.24","ecosystem":"go"},{"name":"Ubuntu","fixed":[],"ecosystem":"linux"},{"name":"Red Hat Enterprise Linux","fixed":[],"ecosystem":"linux"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"- uname -r, then compare against your distro's advisory for CVE-2026-98432 (fixed versions per distro unknown; Ubuntu/RHEL fixes pending as of Oct 29)\n- Look for MPTCP listeners: ss -ltnM (or ss -lM) shows sockets using MPTCP; also check sysctl net.mptcp.enabled\n- Find Go services built with Go 1.24 or later: go version -m <binary>; check for GODEBUG=multipathtcp=0 in their environment or 'godebug multipathtcp=0' in go.mod","fix":"- Install a kernel with the upstream fix (commit e3f33b0a1d89) as soon as your distro ships one; this is the real fix\n- Until then, turn off MPTCP for Go services: set GODEBUG=multipathtcp=0 in the service environment, or add 'godebug multipathtcp=0' to go.mod and rebuild\n- Where you do not need MPTCP, disable it host-wide with sysctl -w net.mptcp.enabled=0 (persist in /etc/sysctl.d)\n- Treat these as partial mitigations: the Go team says the bug is not MPTCP-specific","status":"open","published_at":null,"first_seen_at":"2026-10-30T01:11:42+00:00","triaged_at":"2026-10-30T01:11:42+00:00","updated_at":"2026-10-30T01:11:42+00:00","category":"runtime","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-2026':21A,59B '-202610':30A '-8.1':86B '-98432':22A,60B '1.24':120B '15':195B '27':89B '29':200B '30':160B '5':184B '5.9':85B '9.8':82B 'agent':145B 'also':176B 'anthrop':90B 'api':143B 'attack':105B 'backport':188B 'branch':191B 'bug':19A,164B 'built':94B 'by':40A 'click':98B 'cna':80B 'code':216B 'command':107B 'condit':65B,148B 'confirm':156B 'connect':77B 'cve':20A,58B,192B 'cvss':81B 'default':10A,41A,45A,128B 'distro':83B 'earli':55B 'early-warn':54B 'enterprise':52A 'ex':42A 'exploit':99B,151B,213B,215B 'expos':11A 'fix':26A,181B,206B 'free':69B 'go':1A,32A,43A,48A,119B,121B,138B,153B 'go-programs-on-linux-listen-with-multipath-tcp-by-default-ex':31A 'hat':51A 'host':135B,171B 'in-the-wild':209B 'ipv4':75B 'kernel':18A,47A,73B,79B,207B 'land':182B 'let':101B 'linux':4A,35A,46A,53A,72B,130B,134B 'listen':5A,36A,117B,125B,174B 'may':175B 'meet':146B 'model':93B 'mptcp':44A,116B,124B,169B,173B 'multipath':7A,38A,114B 'network':139B 'oct':88B,159B,183B,194B,199B 'on':34A 'open':123B 'pend':28A 'program':2A,122B 'programs':33A 'proxi':144B 'public':219B 'publish':193B 'race':64B 'race-condit':63B 'red':50A 'remot':16A,104B 'remote-root':15A 'report':214B 'rhel':25A,203B 'risk':179B 'root':17A,109B 'run':106B,136B 'said':91B,162B 'score':84B 'secur':154B 'server':12A,111B,142B 'servic':140B 'setup':78B 'sinc':118B 'socket':126B 'specif':167B 'stabl':190B 'still':27A 'tcp':8A,39A,76B,115B 'team':155B 'tech':29A 'techniqu':57B 'ubuntu':23A,49A,201B 'unauthent':103B 'unpatch':133B 'upstream':180B 'use':67B 'use-after-fre':66B 'warn':56B 'web':141B 'wild':212B 'with':37A 'without':172B 'zero':97B 'zero-click':96B","nicknames":["Go MPTCP default"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T15:57:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202610-go-programs-on-linux-listen-with-multipath-tcp-by-default-ex","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-30T01:11:42+00:00","fetched_at":"2026-10-30T01:11:42+00:00","note":null}],"documents":[{"id":20289,"url":"https://news.ycombinator.com/item?id=50298526","title":"Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432","kind":"post","source":"hackernews","publisher":null,"text":"Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432\nhttps://groups.google.com/g/golang-announce/c/PCoQcdxoScw\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-30T00:52:33+00:00","relation":"describes","confidence":null,"note":null},{"id":20410,"url":"https://groups.google.com/g/golang-announce/c/PCoQcdxoScw","title":"Go Security Team: Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432","kind":"advisory","source":"analyst","publisher":null,"text":"Go security team notice. Linux kernel CVE-2026-98432 is a use-after-free in IPv4 TCP connection handling. Anthropic's exploit gets remote code execution against a server with Multipath TCP (MPTCP) listeners. The bug is not specific to MPTCP, so systems without MPTCP listeners may also be vulnerable to similar attacks. Since Go 1.24, Go programs enable MPTCP by default for listening sockets on Linux. Best fix: upgrade to a patched kernel. Mitigations: GODEBUG=multipathtcp=0 at runtime; 'godebug multipathtcp=0' in go.mod at build time; SetMultipathTCP on net.Dialer / net.ListenConfig per socket. The Go team calls disabling MPTCP a fragile mitigation (one exposed MPTCP listener still leaves the system vulnerable) and says it is premature to change Go's default; discussion at go.dev/issue/82717. No in-the-wild exploitation mentioned.","published_at":"2026-10-30T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":20411,"url":"https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html","title":"Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions","kind":"blog","source":"analyst","publisher":null,"text":"CVE-2026-98432: race-condition use-after-free in the Linux kernel code that sets up new IPv4 TCP connections; kernel CNA CVSS 9.8, Red Hat/Amazon/Oracle/SUSE score 5.9-8.1. Anthropic said on October 27 its AI model wrote an exploit letting a remote unauthenticated attacker run commands as root on Linux servers with a multipath TCP listener. Fix credits Anthropic researcher Xinyang Ge; patched upstream and backported to maintained stable branches (CVE published Oct 15). As of October 29, Ubuntu and RHEL had not released a fixed kernel. On Linux an application must request MPTCP when opening a socket. Related analysis (threatlandscape.io): introduced by commit 079096f103fa, kernels from roughly 4.4, upstream fix e3f33b0a1d89; no in-the-wild reports, not in CISA KEV.","published_at":"2026-10-29T15:57:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}