What changed
On October 29, 2026, the Go Security Team issued an advisory for Linux kernel CVE-2026-98432, a race-related use-after-free in IPv4 TCP connection handling. Go 1.24 and newer enable Multipath TCP (MPTCP) on Linux listening sockets by default, creating a configuration matching the proof-of-concept described by Anthropic on October 27. Anthropic reports its unreleased research model developed a zero-click remote-root exploit in a controlled lab against an MPTCP listener; the kernel flaw has upstream fixes, but downstream distribution availability varies. Go maintainers have not announced a default change; discussion is ongoing in issue #82717.
Why it matters
A developer may deploy an ordinary Go HTTP service without consciously opting into MPTCP, while the underlying Linux kernel supplies the vulnerable TCP implementation. Rebuilding a Go binary or updating Go modules does not patch the kernel. Operators need to inventory internet-facing Linux listeners, verify fixed packages from their actual distribution and reboot into the patched kernel. There is no established exploitation in the wild from the sources inspected, and the demonstrated exploit should not be treated as proof that every TCP listener is practically exploitable.
The underlying defect is in Linux, not Go
The kernel bug is an IPv4 TCP use-after-free during connection setup. The Linux kernel CVE team rates it critical, while distribution-specific severity assessments differ. Anthropic reports a working remote-root chain on a server with an MPTCP listener. The exploit was a lab demonstration, not a documented live compromise. Other paths may exist because the underlying race is not specific to MPTCP.
Why ordinary Go services can be exposed
Go 1.24 made MPTCP the default for Linux listening sockets. Applications using net.Listen or server frameworks can therefore expose MPTCP without explicitly requesting it, depending on kernel support. The Go security team and maintainers acknowledged the concern on October 29. A proposal to disable the default remains under discussion; no change should be assumed.
Kernel patching is the primary remediation
Upstream fixed the defect and backported it to maintained stable branches. Distribution kernels use their own backport and package numbering: do not decide safety solely from the upstream version string. As of October 29–30, reporting based on vendor trackers found Debian fixes available while several Ubuntu and Red Hat families still listed affected streams pending; check live vendor advisories before acting. Install the fixed distribution kernel and reboot, then verify the running kernel.
MPTCP can be disabled temporarily, but that is not a fix
The Go advisory documents GODEBUG=multipathtcp=0 for a running program or a godebug multipathtcp=0 directive in go.mod for the main module. Per-socket APIs can override this setting. The team explicitly calls application-level disabling fragile: one missed listener leaves exposure, and non-MPTCP attack paths cannot be ruled out. Treat it as an interim risk-reduction measure, not a substitute for kernel remediation.
Evidence and limits
Anthropic's exploit timings and impact are vendor-reported lab results; the exploit code is not public in the cited disclosure. Independent coverage cross-checked the kernel CVE and distribution trackers, but did not independently reproduce remote-root exploitation. The Go team considers it premature to change language defaults solely because of this kernel issue. No confirmed widespread exploitation was established.