Cyber ·
CVE-2026-98432: advisory on disabling MPTCP on Linux systems running Go programs
Advisory from the oss-sec list, dated October 30, 2026, about CVE-2026-98432. It describes how to disable MPTCP system-wide on Linux and warns of possible errors in new connections from Go programs already running.
An advisory published on October 30, 2026 on the oss-sec list, by John Haxby, addresses CVE-2026-98432 and Go programs on Linux systems. The text shared is an automatic translation of the feed content. The advisory states that MPTCP (Multipath TCP) can be disabled system-wide with the command sysctl -w net.mptcp.enabled=0. The author himself acknowledges that this measure will cause problems for programs that need MPTCP. Citing the Go source code in version go1.27.3, he also indicates that new Go programs started after the change should work correctly, while programs already running may show unexpected errors in new connections. For server administrators, the key point is to assess whether disabling it is feasible before applying it and to review the affected processes. The source alone does not describe the full extent of the vulnerability, the affected versions or other mitigations. To confirm scope and dates, consult the oss-sec list and the official CVE registry. Rota Nacional does not patch or change kernel settings on third-party servers and does not solve the technical problem described.
Original source: Re: Como se proteger contra a CVE-2026-98432 ao usar programas Go