Go 1.24 MPTCP defaults expose Linux servers to kernel RCE risk

A critical security vulnerability in the Linux kernel, identified as CVE-2026-98432, poses a severe risk to servers running Go applications. The issue involves a use-after-free bug in IPv4 TCP connection handling that can lead to Remote Code Execution. Because Go version 1.24 enables Multipath TCP (MPTCP) by default on Linux, many modern Go services are inadvertently exposed to this attack vector unless specific mitigations are applied or the kernel is patched.

What happened

The Go team issued an urgent advisory following the disclosure of CVE-2026-98432. This vulnerability resides in the Linux kernel and affects how it handles IPv4 TCP connections. Security researchers at Anthropic demonstrated a practical exploit where a server listening for MPTCP connections could be compromised, allowing an attacker to execute arbitrary code remotely. While the proof-of-concept specifically targeted systems with active MPTCP listeners, the underlying memory corruption bug is not strictly limited to MPTCP traffic. This means that even systems not explicitly configured for multipath networking might remain vulnerable to similar exploitation techniques.

The core concern for the Go community stems from a change introduced in Go 1.24. In this version, the runtime automatically enables MPTCP for all listen sockets on Linux systems. This default behavior was intended to improve network resilience and performance but has now become a significant attack surface due to the kernel flaw. The Go maintainers emphasize that while disabling MPTCP in the application layer provides a temporary shield, it is not a complete solution. The fundamental fix requires updating the host operating system to a kernel version that includes the patch for CVE-2026-98432.

How it works

Multipath TCP is an extension to the standard TCP protocol that allows a single connection to use multiple network paths simultaneously. This improves reliability and throughput by aggregating bandwidth or switching paths if one fails. In Go 1.24, the net package automatically sets the necessary socket options to enable MPTCP when creating listeners on Linux. This happens transparently, meaning developers do not need to write extra code to activate it.

The vulnerability CVE-2026-98432 is a use-after-free error in the kernel’s TCP stack. When the kernel processes certain TCP packets, it may free a memory object prematurely but continue to reference it. An attacker can craft specific packets to trigger this condition, potentially overwriting memory structures and gaining control of the execution flow. Since Go 1.24 opens the door for MPTCP negotiation by default, any Go service listening on a public interface becomes a potential target for this kernel-level exploit, regardless of whether the application logic actually uses multipath features.

Key details

• Vulnerability ID: CVE-2026-98432 affects Linux kernel IPv4 TCP handling.
• Impact: Remote Code Execution (RCE) is possible via crafted packets.
• Go Version: Go 1.24 enables MPTCP by default for listen sockets on Linux.
• Primary Fix: Upgrade the Linux kernel to a patched version immediately.
• Runtime Mitigation: Set GODEBUG=multipathtcp=0 in the environment to disable MPTCP.
• Build-time Mitigation: Add godebug multipathtcp=0 to the go.mod file.

Why it matters

For software engineers and technical leads, this incident highlights the hidden dependencies between application runtimes and operating system kernels. Many teams assume that updating their language runtime or application code is sufficient for security. However, because Go 1.24 changes a low-level networking default, it interacts dangerously with an unpatched kernel. This creates a scenario where a secure application codebase can still be compromised due to infrastructure-level vulnerabilities. It forces DevOps and platform teams to coordinate kernel patches across all production environments urgently.

Furthermore, the advisory warns against relying solely on application-level disables. Setting GODEBUG=multipathtcp=0 is described as a "fragile mitigation." If a single service instance is misconfigured or if a new service is deployed without this flag, the entire host remains at risk. Additionally, this approach assumes that all exploits require an active MPTCP listener, which may not be true given the general nature of the use-after-free bug. This uncertainty means that disabling MPTCP is a stopgap measure, not a long-term security strategy.

What you can do

• Prioritize patching your Linux kernels to versions that resolve CVE-2026-98432.
• If immediate kernel updates are impossible, set GODEBUG=multipathtcp=0 in your production environment variables.
• Add godebug multipathtcp=0 to your go.mod file to enforce the disablement at build time.
• Audit your infrastructure to ensure no legacy services are accidentally exposing MPTCP listeners.
• Monitor the discussion on the Go issue tracker for future changes to default behaviors.
• Review use of net.Dialer.SetMultipathTCP and net.ListenConfig.SetMultipathTCP to explicitly manage socket behavior.