{"slug": "go-programs-enable-mptcp-by-default-exposing-them-to-linux-cve-2026-98432", "title": "Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432", "summary": "The Go Security Team warned that Go programs have enabled Multipath TCP (MPTCP) by default for Linux listen sockets since Go 1.24, exposing them to CVE-2026-98432, a use-after-free flaw in the Linux kernel's IPv4 TCP connection handling that Anthropic demonstrated can lead to remote code execution against servers with MPTCP listeners. The team said the best fix is upgrading to a patched kernel version, and that MPTCP can be disabled at runtime with \"GODEBUG=multipathtcp=0\" or at build time with \"godebug multipathtcp=0\" in the main module's go.mod, or per-socket via net.Dialer.SetMultipathTCP and net.ListenConfig.SetMultipathTCP. The Go Security Team called per-program disabling a \"fragile mitigation\" because the underlying bug is not specific to MPTCP and a single exposed listener still leaves a system vulnerable, and said it believes it is premature to change Go's default MPTCP behavior, with further discussion to take place at go.dev/issue/82717.", "body_md": "Hi Gophers,\n\nThe recent disclosure of \n\n[CVE-2026-98432](https://nvd.nist.gov/vuln/detail/cve-2026-98432)\n describes a use-after-free issue which impacts IPv4 TCP connection handling in the Linux kernel. In an exploit \n\n[described by Anthropic](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude)\n, a server using \n\n[Multipath TCP](https://en.wikipedia.org/wiki/Multipath_TCP)\n (MPTCP) listeners is shown to be vulnerable to Remote Code Execution (RCE).\n\n**The best fix for this vulnerability is to upgrade to a patched kernel version.**\nWhile the demonstrated exploit requires the target system to expose an MPTCP listener, the underlying bug is not specific to MPTCP. It is possible that systems with no MPTCP listeners are vulnerable to similar attacks.\n\n[As of Go 1.24](https://go.dev/doc/godebug#go-124)\n, Go programs enable MPTCP by default for listen sockets on Linux. This default may be changed by setting the \"multipathtcp\" GODEBUG:\n\n- Setting \"GODEBUG=multipathtcp=0\" in a program's environment will disable MPTCP by default at runtime.\n- Placing \"godebug multipathtcp=0\" in the main module's go.mod file will disable MPTCP by default at build time.\n\nPrograms may also explicitly enable or disable MPTCP on a per-socket basis, using \n\n[net.Dialer.SetMultipathTCP](https://pkg.go.dev/net#Dialer.SetMultipathTCP)\n and \n\n[net.ListenConfig.SetMultipathTCP](https://pkg.go.dev/net#ListenConfig.SetMultipathTCP)\n. These functions override the GODEBUG setting.\n\nNote that disabling MPTCP on a program-by-program basis is a fragile mitigation. Accidentally leaving a single MPTCP listener exposed will still leave a system vulnerable. Further, it assumes that all viable exploits for this bug depend on MPTCP. Again, we strongly recommend upgrading to a patched kernel version.\n\nAt this time, we believe it is premature to consider making any changes to Go (such as changing the default MPTCP behavior) in reaction to this issue. Further discussion of the issue and how we might respond to it will happen on \n\n[https://go.dev/issue/82717](https://go.dev/issue/82717)\n.\n\n- Go Security Team", "url": "https://wpnews.pro/news/go-programs-enable-mptcp-by-default-exposing-them-to-linux-cve-2026-98432", "canonical_source": "https://groups.google.com/g/golang-announce/c/PCoQcdxoScw", "published_at": "2026-10-30 00:52:33+00:00", "updated_at": "2026-10-30 01:16:51.796084+00:00", "lang": "en", "topics": ["ai-safety"], "entities": ["Go Security Team", "CVE-2026-98432", "Anthropic", "Linux kernel", "Multipath TCP", "Go 1.24", "net.Dialer.SetMultipathTCP", "net.ListenConfig.SetMultipathTCP"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/go-programs-enable-mptcp-by-default-exposing-them-to-linux-cve-2026-98432", "markdown": "https://wpnews.pro/news/go-programs-enable-mptcp-by-default-exposing-them-to-linux-cve-2026-98432.md", "text": "https://wpnews.pro/news/go-programs-enable-mptcp-by-default-exposing-them-to-linux-cve-2026-98432.txt", "jsonld": "https://wpnews.pro/news/go-programs-enable-mptcp-by-default-exposing-them-to-linux-cve-2026-98432.jsonld"}}