Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432

A security warning describes CVE-2026-98432, a use-after-free flaw in Linux kernel handling of IPv4 TCP connections. An exploit demonstrated by Anthropic achieves remote code execution against a server with a Multipath TCP (MPTCP) listener. Although the demonstrated attack requires such a listener, the underlying flaw is not limited to MPTCP, so systems without MPTCP listeners may still face related attacks. The primary recommendation is to upgrade to a kernel version that includes a fix.

Go programs on Linux have enabled MPTCP by default for listening sockets since Go 1.24. Administrators can turn off that default at runtime with `GODEBUG=multipathtcp=0` or at build time with `godebug multipathtcp=0` in the main module’s `go.mod` file. Programs can also set MPTCP behavior for individual sockets through `net.Dialer.SetMultipathTCP` and `net.ListenConfig.SetMultipathTCP`; those explicit choices override the GODEBUG setting. The Go security team cautions that disabling MPTCP in individual programs is a fragile stopgap: one overlooked listener could preserve exposure, and other exploits may not depend on MPTCP. The team considers it too early to change Go’s default behavior and is continuing to discuss possible responses.