CVE-2026-98432 is a use-after-free vulnerability in the Linux kernel's IPv4 TCP handling that can lead to remote code execution via MPTCP listeners. Go 1.24 enables MPTCP by default on Linux, so users are advised to either upgrade to a patched kernel or disable MPTCP via GODEBUG=multipathtcp=0 as a mitigation.
Background
CVE-2026-98432 was disclosed with an exploit demonstration by Anthropic showing RCE via MPTCP. Go 1.24 changed the default behavior on Linux to enable Multipath TCP for listen sockets, making this vulnerability particularly relevant to Go developers.
- Source
- Lobsters
- Published
- Oct 31, 2026 at 01:54 AM
- Score
- 7.0 / 10