Go sockets will default to MPTCP if it is supported by the OS, so most Go servers on Ubuntu (among others) will be vulnerable. The race needs time to trigger, but doesn't mean this should be ignored. If you have publicly exposed Go servers:
1) Disable MPTCP now, and
2) Patch when there's a fix from your distro
@Canonical any timeline for the patch?
1) Disable MPTCP now, and
2) Patch when there's a fix from your distro
@Canonical any timeline for the patch?
I spent the last few hours going down the CVE-2026-98432 Critical Linux Kernel Flaw rabbit hole 🕳️ and here are a few thoughts:View quoted post on X
- It is legit and scary. Kinda crazy that it's been known for 2 weeks & there is still no patch for popular distros (the Ubuntu fix, for example, is developed but not publicly released, still in testing).
- MPTCP needs to be enabled, and on some unorthodox port. It seems that ISPs globally have started blocking options on 22, 80, 443 and other popular ports (good!).
- If you're running a server with valuable data, disable MPTCP and/or IP options NOW. They are not necessary in 99% of use cases anyways.
- It takes about 50 minutes on average to gain access to a server if all conditions are met. My servers started getting hit today; luckily the script I shared earlier handled the situation and rejected the probes.
Stay safe & enjoy the wild AI psychosis ride we're in.