Vulnerability · critical · CVSS 9.8
Checking Go servers for MPTCP listeners to mitigate CVE-2026-98432
Tier A · Patch today – Before you go home
Who’s exposed: Go servers with MPTCP listeners
Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover
Reach
Attack
Damage
Fix
Core infrastructure · Popular tool · Public exploit · Remote, no login · Full takeover
What to do
- Check Go servers for MPTCP listeners
- Turn off Multipath TCP on affected Go servers
The Brief
- Turning off Multipath TCP in a Go server removes the condition the published exploit for CVE-2026-98432 needs.
- Disabling MPTCP does not fix the underlying kernel bug.
- Anthropic described the exploit on October 27 as zero-click remote code execution.
Why it matters
Developers running Go servers with MPTCP listeners can reduce their exposure to the published exploit by turning MPTCP off while the kernel bug remains unfixed.
The checklist behind the tier
Checklist · 6 of 10 yes
| Yes | Hits tech teams | Judgment: the MPTCP kernel flaw affects Linux and servers that developers and ops teams run. |
| Yes | Core infrastructure | Judgment: the Linux kernel is core infrastructure nearly every team runs. |
| Yes | Popular tool | Judgment: the Linux kernel is a widely used OS component, so yes. |
| No | Exploited in the wild | DEV Community: describes a published exploit but reports no observed attacks in the wild. |
| Yes | Public exploit | DEV Community: refers to 'the published exploit for CVE-2026-98432' that the condition enables. |
| Yes | Remote, no login | CVSSCVE-2026-98432: CVSS 9.8 – network, no privileges, no user interaction |
| Yes | Full takeover | CVSSCVE-2026-98432: CVSS rates confidentiality and integrity impact high |
| No | Secrets exposed | DEV Community: the excerpt reports no stolen credentials, keys, configs, or data. |
| No | Supply chain | DEV Community: describes a kernel bug, not compromised packages, updates, or pipelines. |
| No | No fix yet | DEV Community: says disabling MPTCP leaves the bug in place but does not state whether a patch exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-98432 ↗CVSS 9.8 critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ipv4: free inet_opt and ireq_opt after an RCU grace period
- Exploited
- Not in CISA’s exploited catalog
- EPSS
- <1% chance of exploitation in the next 30 days · higher than 56% of all CVEs
Timeline
Anthropic describes the published exploit for CVE-2026-98432 as zero-click remote code execution
DEV Community: backend
How to check for Go MPTCP listeners and turn them off
Source
How to check for Go MPTCP listeners and turn them off ↗ DEV Community: backend · 2h ago
First seen · 1 source · Full story page · How tiers are decided