---
id: "TECH-202610-go-programs-on-linux-listen-with-multipath-tcp-by-default-ex"
kind: "technique"
aliases: []
title: "Go programs on Linux listen with Multipath TCP by default, exposing servers to the remote-root kernel bug CVE-2026-98432 (Ubuntu and RHEL fixes still pending)"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Linux kernel", "fixed": [], "ecosystem": "linux"}, {"name": "Go", "fixed": [], "versions": ">=1.24", "ecosystem": "go"}, {"name": "Ubuntu", "fixed": [], "ecosystem": "linux"}, {"name": "Red Hat Enterprise Linux", "fixed": [], "ecosystem": "linux"}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-30T01:11:42+00:00"
updated_at: "2026-10-30T01:11:42+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-30T01:11:42+00:00"}]
---

# Go programs on Linux listen with Multipath TCP by default, exposing servers to the remote-root kernel bug CVE-2026-98432 (Ubuntu and RHEL fixes still pending)

CVE-2026-98432 is a race-condition use-after-free in the Linux kernel's IPv4 TCP connection setup (kernel CNA CVSS 9.8; distros score 5.9-8.1). On Oct 27 Anthropic said its model built a zero-click exploit that lets an unauthenticated remote attacker run commands as root on servers with a Multipath TCP (MPTCP) listener. Since Go 1.24, Go programs open MPTCP listening sockets by default on Linux, so any unpatched Linux host running a Go network service (web servers, APIs, proxies, agents) meets the condition from that exploit. The Go security team confirmed this on Oct 30 and said the bug is not specific to MPTCP, so hosts without MPTCP listeners may also be at risk. Upstream fix landed Oct 5 and has been backported to stable branches (CVE published Oct 15), but as of Oct 29 Ubuntu and RHEL had no fixed kernel. No in-the-wild exploitation reported; exploit code is not public.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- linux:Linux kernel affected ? fixed ?
- go:Go affected ? fixed ?
- linux:Ubuntu affected ? fixed ?
- linux:Red Hat Enterprise Linux affected ? fixed ?

## How to check

- uname -r, then compare against your distro's advisory for CVE-2026-98432 (fixed versions per distro unknown; Ubuntu/RHEL fixes pending as of Oct 29)
- Look for MPTCP listeners: ss -ltnM (or ss -lM) shows sockets using MPTCP; also check sysctl net.mptcp.enabled
- Find Go services built with Go 1.24 or later: go version -m <binary>; check for GODEBUG=multipathtcp=0 in their environment or 'godebug multipathtcp=0' in go.mod

## Fix

- Install a kernel with the upstream fix (commit e3f33b0a1d89) as soon as your distro ships one; this is the real fix
- Until then, turn off MPTCP for Go services: set GODEBUG=multipathtcp=0 in the service environment, or add 'godebug multipathtcp=0' to go.mod and rebuild
- Where you do not need MPTCP, disable it host-wide with sysctl -w net.mptcp.enabled=0 (persist in /etc/sysctl.d)
- Treat these as partial mitigations: the Go team says the bug is not MPTCP-specific

## Timeline

- 2026-10-30T01:11:42+00:00 analyst

## Documents

- [describes] Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432 https://news.ycombinator.com/item?id=50298526
- [describes] Go Security Team: Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432 https://groups.google.com/g/golang-announce/c/PCoQcdxoScw
- [describes] Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_