EDITOR WIRE | 2026-10-30 | BLOCK 973833
BITCOIN $77,540 | GOLD $3,915 | OIL $113.31 | S&P 500 $7,611 | US 10Y 4.96%
Linux remote-root demonstration prompts Go warning over CVE-2026-98432
The Go Security Team is urging Linux operators to install patched kernels after Anthropic reported an attack demonstration that runs commands as root on a server exposing a Multipath TCP listener, without credentials or user interaction. The flaw, CVE-2026-98432, is in the kernel's IPv4 TCP connection handling—not Go itself—and disabling MPTCP does not repair the underlying vulnerability.
Published October 15, the vulnerability is a use-after-free: concurrent connection-handling paths can leave one processor reading memory that another has already freed. Anthropic says it turned that race into a leak of kernel addresses and then attacker-chosen command execution as root. Its proof of concept took 48 minutes to obtain a kernel pointer and another five minutes to reach command execution. Those are measurements from its research setup, not a guaranteed attack time against other servers. The reviewed sources do not establish exploitation in the wild.
The exposure can arise before a service's login or other application-level authentication. On an affected host with a reachable MPTCP listener, malicious network traffic reaches the vulnerable kernel code during connection establishment. Successful exploitation could give an attacker control of the host, potentially exposing service secrets, allowing workloads to be modified or taking services offline. Those are possible consequences of root access, not reported losses from this disclosure.
Go's October 29 warning matters because version 1.24 introduced MPTCP-enabled listeners by default on Linux. That does not mean every binary built with a recent compiler exposes the demonstrated path: defaults also depend on the Go version declared by the application module and explicit overrides, while actual operation depends on kernel support and configuration. Operators need to check the running service and kernel rather than infer exposure from a compiler version alone.
The warning has reached Bitcoin infrastructure operators. In an October 30 X post, Peter Todd advised people running lnd on Linux with open ports to shut it down until they patch the kernel or otherwise mitigate the issue, stressing that it was not lnd's fault. His warning is not evidence that every lnd deployment exposes MPTCP or that funds have been stolen; the relevant vulnerability is in the host kernel.
The Go team lists temporary ways to disable default MPTCP behavior: setting GODEBUG=multipathtcp=0 in the program's environment, or adding godebug multipathtcp=0 to the main module's go.mod at build time. Explicit per-socket SetMultipathTCP calls override that default. The team calls application-by-application disabling fragile: one overlooked MPTCP listener preserves the demonstrated exposure, and other attacks against the underlying bug may not require MPTCP at all.
Patches are already available upstream and for some distributions; the gap is whether a fixed package has shipped for an operator's exact distribution and kernel flavor. Debian's tracker marks linux 6.1.190-1 in bookworm security and 6.12.113-1 in trixie security as fixed. It is therefore incorrect to describe this as a Linux-wide vulnerability with no patch available.
The upstream CVE record lists fixes in Linux 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10, and mainline 7.3. These are branch-specific fixed releases, not a rule that every kernel below 7.3 remains vulnerable. Distribution packages may carry backported fixes under different version numbers. Operators should check their vendor's status for the exact installed kernel package, follow its update and activation procedure, and verify that the patched kernel is actually running—not merely installed.
The practical distinction is between removing one demonstrated attack path and fixing the host vulnerability. Rebuilding a Go service or disabling MPTCP may reduce exposure, but neither removes the kernel memory error. The Go team's recommended durable response is a patched kernel.
Sources:
https://cveawg.mitre.org/api/cve/CVE-2026-98432
https://www.anthropic.com/research/discovering-vulnerabilities-with-claude
https://www.openwall.com/lists/oss-security/2026/10/30/1
https://go.dev/doc/godebug
https://x.com/peterktodd/status/2116039505954185279
https://security-tracker.debian.org/tracker/CVE-2026-98432