Sunday, November 1, 2026
IT BusinessDigest
Get the Daily Brief
News

Linux flaw CVE-2026-98432: why Go 1.24 services are exposed

Ubuntu and Red Hat had no fixed kernel as of October 30. The Go team won't change its default, so the check falls to you: find MPTCP listeners, set the Go switch, and reboot into a fixed kernel as soon as one ships.

Morgan Reid Security and infrastructure writer · · 4 min read
Close-up of server cooling fans in a vibrant data center

CVE-2026-98432 is a use-after-free bug in the Linux kernel code that accepts new IPv4 TCP connections, and it goes back to kernel 4.4. Anthropic said on October 27 that an unreleased Claude model wrote an exploit for it that gave a remote attacker with no login root on a server running a multipath TCP (MPTCP) listener. The address leak took 48 minutes and command execution 5 more. The Linux kernel's CVE team scores it 9.8. Red Hat's CVE page scores it 5.9 and treats it as a possible denial of service, and Oracle and SUSE put it at 8.1.

The follow-up question is which servers have an MPTCP listener, and the answer includes services nobody set up that way. Since Go 1.24, Go programs on Linux turn MPTCP on by default for listening sockets, the Go Security Team wrote on October 29. Neither the CVE record nor the kernel fix mentions MPTCP.

What the Go team will and won't do

Go has three ways to turn MPTCP off: set GODEBUG=multipathtcp=0 in the service's environment, put the line godebug multipathtcp=0 in go.mod for the main module and rebuild, or call SetMultipathTCP on a listener in code. A per-socket call overrides the GODEBUG setting, so an environment variable will not catch code that turns MPTCP on itself.

The Go Security Team calls this fragile. The bug is in IPv4 TCP handling, not in MPTCP, so a server without MPTCP may still be open to some other attack. Its advice is to upgrade to a patched kernel. It also said changing Go's default now would be premature. On the public proposal to disable MPTCP by default (Go issue 82717), Ian Lance Taylor argued on October 30 that a security bug is no reason to turn the feature off. The issue is still open.

No attacks have been reported, and it was not on CISA's Known Exploited Vulnerabilities list as of October 30. Anthropic has not published its exploit code or kernel configuration, and no one has shown remote code execution on a server without an MPTCP listener. IPv6 connections are not affected.

Which kernels are fixed

The upstream fix is in stable kernels 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10, and in 7.3. Distributions backport fixes, so go by your vendor's advisory, not version numbers. Status as of October 30:

  • Fixed: Debian 12 (kernel 6.1.190-1) and Debian 13 (6.12.113-1), Oracle Linux 7 to 10 with UEK, Amazon Linux 2023's optional kernel6.18 and kernel6.12 packages, SUSE Linux Micro 6.2 and openSUSE Leap 16.0.
  • In testing: AlmaLinux 8, 9 and 10. AlmaLinux backported the fix itself on October 30 instead of waiting for Red Hat.
  • No fix yet: Ubuntu 22.04, 24.04, 26.04 and 26.10 (work in progress), RHEL 8, 9 and 10, OpenShift 4, Amazon Linux 2023's default kernel, Amazon Linux 2 and SLES 15 SP7. Neither Ubuntu nor Red Hat has given a date. Rocky Linux 8 to 10 are also affected. RHEL 7 is not.

Red Hat says none of the mitigations on offer clears its bar for stability, ease of deployment and fit for most installations.

What IT teams should do

  1. Run ss -Mlnp on internet-facing Linux hosts to list MPTCP listeners and the processes behind them. Check that net.ipv4.tcp_migrate_req is 0, since the migration path is affected too.
  2. For each Go service on the list, set GODEBUG=multipathtcp=0 now and add the go.mod line at the next build. Ask vendors of Go-based agents what they have changed.
  3. Install the fixed kernel where one exists and reboot, since it does nothing until the host boots into it. Confirm with uname -r and needs-restarting -r or /var/run/reboot-required.
  4. On RHEL and Ubuntu, limit who can reach exposed services until a kernel ships. CIQ, which supports Rocky Linux, has published nftables rules that drop IPv4 TCP packets carrying IP options, BleepingComputer reports. PatchMon says its own IP-options rule blocks only part of the trigger and that no vendor has confirmed this kind of filtering as a fix, so test it first and treat it as a stopgap.
  5. AlmaLinux users can take the testing kernels, then switch the testing repository off.

For other patches this month, see our Brotli patch order and the VeloCloud zero-day guide.

Sources: Go Security Team announcement on golang-announce (October 29), Go issue 82717, AlmaLinux, OpenCVE record, BleepingComputer, The Hacker News, PatchMon, CSO Online.

Sources