Comment by asveikau
12 hours ago
> TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8
I know it's customary for HN to edit titles to remove extraneous information, but removing "Linux" here really takes away something useful and relevant. This is a Linux vulnerability. If you're running *BSD or Mac or Windows, not affected.
Quite, however it looks quite rare:
"Why it's urgent: the bug sits in code every Linux server runs when it accepts an IPv4 TCP connection, before any application sees the connection. Anthropic, whose researcher reported it, says its Claude model wrote a working proof-of-concept exploit that runs commands as root on "Linux servers with a multipath TCP listener," with no credentials. Go programs open those listeners by default, per the Go Security Team. See the timeline."
I don't know of any Linux boxes running a multipath TCP listener in my care and I have quite a few. MP generally implies a router of some sort and the intersections in a Venn diagram continue to get smaller ...
This is still an issue and must be patched but I think it will be rare, very rare.
This is not rare. Every TCP connection in Go by default enables MPTCP [1]. Simply running a Go program that uses TCP without explicitly disabling this behavior will cause the running kernel to be vulnerable.
1: https://groups.google.com/g/golang-announce/c/PCoQcdxoScw
But any sane configuration would have the MPTCP port blocked behind a firewall (unless you were intentionally using MPTCP).
2 replies →
Try:
to check. If you're running any Go code, you may be surprised. I was.
It seems like the anthropic PoC involves MPTCP, but the bug itself is not in the MPTCP code, it's in a generic TCP codepath relating to options, MPTCP was probably just a convenient codepath for memory manipulation.
containerd (docker) uses it
"TCP stack" versus "Linux TCP stack" is an OOM in terms of relevance.
Out of memory?! That's terrible!
That's what I thought, what do they actually mean?
4 replies →