MPTCP

Go programs are now enabling Multipath TCP by default, which makes them vulnerable to the Linux kernel flaw tracked as CVE-2026-98432. The Go team has issued an announcement addressing the change, and developers are debating whether enabling MPTCP out of the box was a good call, given it silently widens the attack surface of everyday Go services running on affected Linux kernels.

A newly disclosed vulnerability, CVE-2026-98432, rated CVSS 9.8, affects the Linux kernel: a race condition in IPv4 TCP connection setup triggers a use-after-free, allowing remote unauthenticated attackers to gain root on hosts with an MPTCP listening socket. Discussion notes that Go 1.24+ enables MPTCP by default, widening exposure, and that an exploit was written with Anthropic's Claude. Upstream patches are available.

A critical vulnerability tracked as CVE-2026-98432 has been identified in the Linux kernel, allowing remote root code execution through race conditions in the MPTCP networking subsystem. The flaw affects multiple distributions, including Ubuntu, and system administrators are being urged to apply patches as they become available.