Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432

The Go Security Team warned that Go programs have enabled Multipath TCP (MPTCP) by default for Linux listen sockets since Go 1.24, exposing them to CVE-2026-98432, a use-after-free flaw in the Linux kernel's IPv4 TCP connection handling that Anthropic demonstrated can lead to remote code execution against servers with MPTCP listeners. The team said the best fix is upgrading to a patched kernel version, and that MPTCP can be disabled at runtime with "GODEBUG=multipathtcp=0" or at build time with "godebug multipathtcp=0" in the main module's go.mod, or per-socket via net.Dialer.SetMultipathTCP and net.ListenConfig.SetMultipathTCP. The Go Security Team called per-program disabling a "fragile mitigation" because the underlying bug is not specific to MPTCP and a single exposed listener still leaves a system vulnerable, and said it believes it is premature to change Go's default MPTCP behavior, with further discussion to take place at go.dev/issue/82717.

Hi Gophers, The recent disclosure of CVE-2026-98432 https://nvd.nist.gov/vuln/detail/cve-2026-98432 describes a use-after-free issue which impacts IPv4 TCP connection handling in the Linux kernel. In an exploit described by Anthropic https://www.anthropic.com/research/discovering-vulnerabilities-with-claude , a server using Multipath TCP https://en.wikipedia.org/wiki/Multipath TCP MPTCP listeners is shown to be vulnerable to Remote Code Execution RCE . The best fix for this vulnerability is to upgrade to a patched kernel version. While the demonstrated exploit requires the target system to expose an MPTCP listener, the underlying bug is not specific to MPTCP. It is possible that systems with no MPTCP listeners are vulnerable to similar attacks. As of Go 1.24 https://go.dev/doc/godebug go-124 , Go programs enable MPTCP by default for listen sockets on Linux. This default may be changed by setting the "multipathtcp" GODEBUG: - Setting "GODEBUG=multipathtcp=0" in a program's environment will disable MPTCP by default at runtime. - Placing "godebug multipathtcp=0" in the main module's go.mod file will disable MPTCP by default at build time. Programs may also explicitly enable or disable MPTCP on a per-socket basis, using net.Dialer.SetMultipathTCP https://pkg.go.dev/net Dialer.SetMultipathTCP and net.ListenConfig.SetMultipathTCP https://pkg.go.dev/net ListenConfig.SetMultipathTCP . These functions override the GODEBUG setting. Note that disabling MPTCP on a program-by-program basis is a fragile mitigation. Accidentally leaving a single MPTCP listener exposed will still leave a system vulnerable. Further, it assumes that all viable exploits for this bug depend on MPTCP. Again, we strongly recommend upgrading to a patched kernel version. At this time, we believe it is premature to consider making any changes to Go such as changing the default MPTCP behavior in reaction to this issue. Further discussion of the issue and how we might respond to it will happen on https://go.dev/issue/82717 https://go.dev/issue/82717 . - Go Security Team