Lightning Labs Ships LND Mitigation for Critical Linux Kernel Bug
Lightning Labs shipped lnd v0.21.6-beta and a v0.20.7-beta backport that disable Multipath TCP listeners by default after a CVSS 9.8 Linux kernel flaw. It is a mitigation, not a fix: operators still need a patched kernel as scanning spreads.
CVSS 9.8. That is the score on a Linux kernel flaw that pushed Lightning Labs to change LND's defaults. lnd v0.21.6-beta and the v0.20.7-beta backport, shipped October 30, switch off Multipath TCP (MPTCP) listeners by default. The project calls it a mitigation, not a fix. Only a patched kernel resolves the underlying bug.
Bitcoin Core and Lightning developer Matt Corallo flagged the vulnerability, tracked as CVE-2026-98432, the same day. It is a use-after-free in the kernel's IPv4 TCP handshake code. Corallo criticized Ubuntu's delayed response and called it "the most critical Linux vuln ever."
Anthropic's Frontier Red Team later showed the flaw could be turned into a remote root exploit against systems exposing an MPTCP listener. That demonstration remains unpublished.
Why LND is exposed
Go 1.24 and later enable MPTCP listeners by default. LND is written in Go, so recent versions listened with MPTCP on peer, gRPC and REST ports whenever the kernel had the feature enabled.
Peter Todd echoed the warning the same day. His advice: anyone running LND on Linux with open ports should shut Lightning nodes down until the kernel is patched or mitigated.
Olaoluwa Osuntokun, known as Roasbeef, recommended the LND update on X.
The release covers only LND. Other services on the same machine stay exposed until MPTCP is disabled host-wide or the kernel is updated.
Scanning, but no confirmed exploitation
Marcus Hutchins reported internet-wide scanning consistent with threat actors hunting for exposed systems. His own scans found roughly 2.1 million servers reachable over MPTCP on port 443. International Cyber Digest amplified the findings on November 4.
No confirmed in-the-wild exploitation has been reported. The flaw is not in CISA's Known Exploited Vulnerabilities catalog. Internet-facing servers carry the most exposure; home desktops behind NAT and firewalls with no public TCP listeners are far less affected.
Patch status by distribution
- Red Hat: fixes for RHEL 8, 9 and 10 shipped November 1.
- Debian, Amazon Linux and others: patched earlier.
- Ubuntu: Canonical has fixed kernels for 22.04, 24.04 and 26.04 in the opt-in proposed pocket, not yet in regular updates.
- UmbrelOS: version 2.0.1 included the kernel fix on November 1 for x86, plus a traffic-blocking mitigation on Raspberry Pi.
What it means for node operators
The LND default change closes the demonstrated path through LND and nothing else on the box. A patched kernel is the actual fix. Until then, disabling MPTCP host-wide covers the other listeners. Ubuntu users who want a fixed kernel now have to opt in to the proposed pocket.
Node software inherits risk from its runtime and operating system. In October, Cloudflare's CEO reported millions of exploit attempts against critical PHP flaws after disclosure. Here, scanning is already underway.
Release details are in the v0.21.6-beta and v0.20.7-beta notes on GitHub.
