Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1108
_____________________________________________________________________

DATE                : 30/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Linux running Go.

====================================================================
https://groups.google.com/g/golang-announce/c/PCoQcdxoScw/m/aD-MgXEvAAAJ
_____________________________________________________________________

Protecting against CVE-2026-98432

Neal Patel
à golang-announce


Hi Gophers,

The recent disclosure of CVE-2026-98432 describes a use-after-free
issue which impacts IPv4 TCP connection handling in the Linux kernel.
In an exploit described by Anthropic, a server using Multipath TCP
(MPTCP) listeners is shown to be vulnerable to Remote Code Execution
(RCE).

The best fix for this vulnerability is to upgrade to a patched kernel
version.

While the demonstrated exploit requires the target system to expose
an MPTCP listener, the underlying bug is not specific to MPTCP. It is
possible that systems with no MPTCP listeners are vulnerable to
similar attacks.

As of Go 1.24, Go programs enable MPTCP by default for listen sockets
on Linux. This default may be changed by setting the "multipathtcp"
GODEBUG:

    Setting "GODEBUG=multipathtcp=0" in a program's environment will
disable MPTCP by default at runtime.
    Placing "godebug multipathtcp=0" in the main module's go.mod file
will disable MPTCP by default at build time.


Programs may also explicitly enable or disable MPTCP on a per-socket
basis, using net.Dialer.SetMultipathTCP and
net.ListenConfig.SetMultipathTCP. These functions override the
GODEBUG setting.

Note that disabling MPTCP on a program-by-program basis is a fragile
mitigation. Accidentally leaving a single MPTCP listener exposed will
still leave a system vulnerable. Further, it assumes that all viable
exploits for this bug depend on MPTCP. Again, we strongly recommend
upgrading to a patched kernel version.

At this time, we believe it is premature to consider making any
changes to Go (such as changing the default MPTCP behavior) in
reaction to this issue. Further discussion of the issue and how we
might respond to it will happen on https://go.dev/issue/82717.


- Go Security Team

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================