A critical vulnerability in the Linux kernel’s IPv4 networking code, tracked as CVE-2026-98432 (CVSS 9.8), allows potential remote, unauthenticated attackers to trigger a use-after-free condition on exposed systems. This vulnerability specifically affects Multipath TCP (MPTCP) handling, but could also impact standard IPv4 traffic as well.

Because Sandfly is built on Go, and recent Go toolchains (Go 1.24+) enable MPTCP on listening sockets by default, we have received questions regarding Sandfly's exposure.

The vulnerability is not in Sandfly's code, but the Linux kernel itself and affects all modern Go infrastructure server ecosystems such as Kubernetes, Docker, and many others. We advise all teams to audit and update their Linux systems that run the Sandfly server (UI and API) and nodes as a precaution.

What Is the Vulnerability?

CVE-2026-98432 is a race condition in the Linux kernel’s IPv4 connection-handling subsystem. When processing inbound connection requests, socket options can be freed while still referenced by the kernel, resulting in memory corruption and denial of service or remote root execution under specific circumstances.

The issue intersects with Go applications because:

* Starting in Go 1.24, the Go runtime attempts to enable MPTCP by default on standard network listeners.
* While upstream Linux released a patch, many production servers running standard distribution kernels remain exposed to this trigger path if they accept IPv4 connections and run software exposing MPTCP listeners.
* While demonstrated exploit chains rely on MPTCP listeners, the underlying memory safety flaw exists in the shared IPv4 TCP code path, meaning non-MPTCP network attack surfaces may also be viable.

Are Systems Sandfly Protects Vulnerable?

Sandfly uses an agentless architecture. This means we are not operating any server itself on systems we monitor. Even though Sandfly itself is safe, your underlying hosts, load balancers, and internal Go or MPTCP-enabled network microservices may be directly exposed by third-parties. This is unrelated to Sandfly and again is downstream of the Linux kernel itself.

Apply Kernel Updates and Reboot

The only definitive remediation is updating your Linux kernel to a patched release provided by your distribution vendor. Check with your OS vendor for their latest kernel security bulletins addressing CVE-2026-98432.

Customers may choose to disable MPTCP system-wide on systems that cannot be patched, but we will not provide specific advice here and advise contacting the OS vendor if you choose this option. The best fix is a kernel upgrade.

Summary

We always recommend restricting access to all security infrastructure (both Sandfly or others) only to those systems and persons that need to communicate with them as an extra precaution. Further, the attack itself requires a significant number of variables to come into alignment for it to work in practice. However, caution indicates that any accessible network listener on an unpatched kernel poses an potential threat to root integrity.

We recommend upgrading your hosts at the earliest convenient maintenance window for systems running the Sandfly infrastructure. Please reach out to our support team if you have any further questions.

Questions?

Not using Sandfly yet?