Linux IPv4 TCP Use-After-Free CVE-2026-98432: Remote RCE
A working, unpublished root exploit over plain TCP exists for servers with an MPTCP listener, which every Go 1.24+ server on Linux opens by default; boot a fixed kernel this week and prioritize internet-facing hosts.
Must act: Anyone running internet- or tenant-facing Linux servers on kernels 4.4 and later that lack the October 2026 fix, especially hosts serving Go 1.24+ programs or other MPTCP listeners.
Can relax: Hosts already booted into a fixed stable or distribution kernel, RHEL 7, and machines that accept no inbound IPv4 TCP connections from untrusted networks.
- Run uname -r on every Linux host and compare it with your distribution's fixed kernel for CVE-2026-98432.
- Install the fixed kernel and reboot into it, starting with internet-facing servers, load balancers and hosts running Go services.
- Where no fix exists yet (Ubuntu, RHEL 9 kernel-rt, OpenShift), list MPTCP listeners with ss -Mltn and set GODEBUG=multipathtcp=0 for Go services or sysctl -w net.mptcp.enabled=0 if nothing needs MPTCP.