mptcp

Go security team warns about CVE-2026-98432, a use-after-free bug in Linux kernel IPv4 TCP handling enabling RCE (exploit demonstrated by Anthropic via MPTCP listeners), recommending a patched kernel upgrade and detailing how to disable MPTCP defaults in Go programs.

Linux 内核 MPTCP TCP 缺陷被评为 9.8 CVSS，Anthropic 演示了可在服务器上以 root 权限执行命令的漏洞利用，Ubuntu 和 RHEL 尚未修复，而 Debian、Oracle 等已发布部分补丁。