Go security team warns about CVE-2026-98432, a use-after-free bug in Linux kernel IPv4 TCP handling enabling RCE (exploit demonstrated by Anthropic via MPTCP listeners), recommending a patched kernel upgrade and detailing how to disable MPTCP defaults in Go programs.
# [security] Protecting against CVE-2026-98432
Source: [https://groups.google.com/g/golang-announce/c/PCoQcdxoScw](https://groups.google.com/g/golang-announce/c/PCoQcdxoScw)
Hi Gophers,
The recent disclosure of[CVE\-2026\-98432](https://nvd.nist.gov/vuln/detail/cve-2026-98432)describes a use\-after\-free issue which impacts IPv4 TCP connection handling in the Linux kernel\. In an exploit[described by Anthropic](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude), a server using[Multipath TCP](https://en.wikipedia.org/wiki/Multipath_TCP)\(MPTCP\) listeners is shown to be vulnerable to Remote Code Execution \(RCE\)\.
**The best fix for this vulnerability is to upgrade to a patched kernel version\.** While the demonstrated exploit requires the target system to expose an MPTCP listener, the underlying bug is not specific to MPTCP\. It is possible that systems with no MPTCP listeners are vulnerable to similar attacks\.
[As of Go 1\.24](https://go.dev/doc/godebug#go-124), Go programs enable MPTCP by default for listen sockets on Linux\. This default may be changed by setting the "multipathtcp" GODEBUG:
- Setting "GODEBUG=multipathtcp=0" in a program's environment will disable MPTCP by default at runtime\.
- Placing "godebug multipathtcp=0" in the main module's go\.mod file will disable MPTCP by default at build time\.
Programs may also explicitly enable or disable MPTCP on a per\-socket basis, using[net\.Dialer\.SetMultipathTCP](https://pkg.go.dev/net#Dialer.SetMultipathTCP)and[net\.ListenConfig\.SetMultipathTCP](https://pkg.go.dev/net#ListenConfig.SetMultipathTCP)\. These functions override the GODEBUG setting\.
Note that disabling MPTCP on a program\-by\-program basis is a fragile mitigation\. Accidentally leaving a single MPTCP listener exposed will still leave a system vulnerable\. Further, it assumes that all viable exploits for this bug depend on MPTCP\. Again, we strongly recommend upgrading to a patched kernel version\.
At this time, we believe it is premature to consider making any changes to Go \(such as changing the default MPTCP behavior\) in reaction to this issue\. Further discussion of the issue and how we might respond to it will happen on[https://go\.dev/issue/82717](https://go.dev/issue/82717)\.
\- Go Security Team
CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP handshake path that could allow remote exploitation, with a Linux CNA CVSS of 9.8 and Red Hat's preliminary 8.1 score, while Anthropic's Frontier Red Team demonstrated remote root execution against an MPTCP listener; the article reviews patch validation and distribution-specific remediation steps.
Linux's stable kernels shipped fixes for CVE-2026-98432, a critical (CVSS 9.8) use-after-free in the IPv4 TCP handshake reachable by remote unauthenticated attackers; Anthropic reported the bug and says its Claude model wrote a working remote root exploit, while Ubuntu and RHEL remain unfixed.
A critical Linux kernel TCP vulnerability with a 9.8 CVSS score has been disclosed, affecting Ubuntu, Red Hat, and other major distributions, prompting widespread patching efforts.
A critical local privilege escalation vulnerability in FreeBSD (CVE-2026-45257) allows an unprivileged user to write arbitrary data into the page cache of any readable file, bypassing file permissions and flags, leading to full root compromise. The bug affects default installations of FreeBSD 13.0 and later via unsafe composition of sendfile, KTLS, and in-kernel AES-GCM decryption.