Protecting against CVE-2026-98432 - Multipath TCP (MPTCP) listeners is shown to be vulnerable to Remote Code Execution (RCE)

#1

Came looking for a little information on this:

https://www.cve.org/CVERecord?id=CVE-2026-98432

... as I understand Channels uses Go, so presumably this on the Go Announce list is relevant?

https://groups.google.com/g/golang-announce/c/PCoQcdxoScw/m/aD-MgXEvAAAJ?pli=1

I don’t personally have ports open to the world, but I know some people do. If that’s you, it might be worth closing them for a little while, at least until your kernel is patched.

Looks like this is purely a wait-for-kernel-patches situation, as opposed to some mitigation in Channels? Or has this already been considered?

#2
  • Setting "GODEBUG=multipathtcp=0" in a program's environment will disable MPTCP by default at runtime.
$ systemctl show channels-dvr -p Environment
Environment=GOMAXPROCS=3 GODEBUG=multipathtcp=0

So much for not using proxies.

Kernel-wide off switch, if you ever want it instead of per-app GODEBUG:

sysctl -w net.mptcp.enabled=0
#3

Disabling MCTCP does not make you safe. This is a complex bug in the Linux TCP stack and the best solution is to upgrade to a patched kernel.

1 Like
#4

I don't think anybody needs mptcp.

#5

-A INPUT -p tcp -m u32 --u32 "0>>24&0xF=6:15" -j DROP

Also seems to be another option, needs to be before any port allows - ideally the very top.

Or, put it into the raw prerouting:

-t raw -A PREROUTING -p tcp -m u32 --u32 "0>>24&0xF=6:15" -j DROP

#6

Unless there is a need to open a host to the internet for public access, the best approach is to use a VPN to access Channels DVR. Even after this vulnerability is fixed, there will be future ones. Not only that, I've never seen the Channels developers state that the penetration test there system and while they do a great job, there may be vulnerabilities.

While a little less convent, not opening firewall holes and using a VPN protects the server from all known, unknown and future vonurabilities.

#7

Except vulnerabilities in the VPN software itself, and the networking stack of the VPN software host OS (if any).