Reminder: High-Severity Use-After-Free Vulnerability (CVE-2026-98432) Found in Linux Kernel's IPv4 TCP
A high-severity use-after-free vulnerability, CVE-2026-98432, exists in the Linux kernel's IPv4 TCP implementation and can be exploited from an unauthenticated network. Anthropic has released an example of an RCE exploit targeting MPTCP listening ports, while the official Go team has noted that MPTCP is enabled by default for listen sockets on Linux starting with Go 1.24.
Reminder: If you have servers, remember to update the kernel. A high-risk use-after-free vulnerability (CVE-2026-98432) exists in the Linux kernel's IPv4 TCP implementation.
- Attackers can exploit this vulnerability from the network side without requiring authentication or user interaction.
- Anthropic has published an example of a remote code execution (RCE) exploit targeting MPTCP listening ports.
- This vulnerability does not only affect MPTCP scenarios. The official Go security team has noted that since Go 1.24, MPTCP has been enabled by default for listen sockets on Linux. Consequently, services written in Go are exposed by default; even without MPTCP listening, they may still be vulnerable to similar attacks.