Repository navigation
Considerer documenting / disabling MPTCP by default due to CVE-2026-98432 #2806
Description
Describe your feature request
CVE-2026-98432 is a critical (CVSS 9.8) use-after-free in the linux kernel's IPv4 TCP stack. A working remote root exploit has been demonstrated against servers that expose an MPTCP listener
Since Go 1.24, the net package enables MPTCP by default on linux listening sockets(when the kernel supports it).
Any public-facing Frankenphp instance running on an un patched Kernel with MPTCP enabled is potentially exposed to the demonstrated RCE path.
Add a short note in the security documentation or deployment.
Relevant references:
Go Security team announcement on CVE 2026-98432 and MPTCP defaults
Linux kernel stable commits addressing the use-after-free
Temporary mitigation:
Runtime: GODEBUG=multipathtcp=0
System-wide: sysctl -w net.mptcp.enabled=0 (require restarting Frankenphp)
after applying the mitigation and restarting: sudo ss -Mlnp (no frankenphp/caddy listeners should appear)
The real fix is to upgrade to a patched kernel
Activity
AlliBalliBaba commentedon Nov 4, 2026
I agree that this CVE needs more visibility, I wouldn't mind highlighting it as issue or mentioning it in the docs or so.
Not sure about disabling MPTCP by default though. This would probably need to happen with Caddy or go directly. But the fault lies with neither and as you mentioned, only updating linux will really resolve it.