CVE-2026-98432 and MTCP in Beszel

[opoupel]

Reading about the CVE-2026-98432 in Linux Kernel, I learned it impacts MPTCP connections. I checked my servers to find if any MPTCP connections were opened and I discovered that Beszel has 2 :

# ss -Mlpn
State      Recv-Q   Send-Q     Local Address:Port      Peer Address:Port   Process                                            
LISTEN     0        4096           127.0.0.1:8090           0.0.0.0:*       users:(("beszel",pid=172,fd=14))                  
LISTEN     0        4096                   *:45876                *:*       users:(("beszel-agent",pid=171,fd=7))

My question is: are this type of connection mandatory for Beszel, or does it comes from Go which binds MPTCP connections ? Can I safely disabled mtcp in sysctl (net.mptcp.enabled=0)?

[svenvg93]

MPTCP isn't something Beszel uses or needs. It comes from Go: since Go 1.24, listening sockets on Linux use MPTCP by default when the kernel supports it, and Beszel just calls the standard net.Listen. Outgoing connections (like the hub connecting to the agent) still use regular TCP by default, so what you see in ss -M is listeners that accept MPTCP. It doesn't mean MPTCP is actually being used between hub and agent.

You can safely set net.mptcp.enabled=0. Go detects that MPTCP isn't available and falls back to plain TCP, and Beszel keeps working normally.

If you'd rather leave MPTCP on for the system and only turn it off for Beszel, set GODEBUG=multipathtcp=0 in the environment of both the hub and the agent.