Linux kernel flaw prompts emergency LND update for Lightning nodes

Emergency LND releases follow warning about a severe Linux kernel bug

Bitcoin and Lightning developer Matt Corallo highlighted a severe Linux kernel vulnerability on October 30. Lightning Labs released emergency LND updates the same day.

The bug is tracked as CVE-2026-98432. It affects the kernel's IPv4 TCP handshake code. It has a CVSS severity score of 9.8.

Key numbers and releases

• CVE-2026-98432, with a CVSS score of 9.8.
• LND v0.21.6-beta and v0.20.7-beta were released as a mitigation.
• About 2.1 million servers were reported reachable over MPTCP on port 443 in later scans.
• Red Hat shipped fixes for RHEL 8, 9 and 10 on November 1.
• UmbrelOS 2.0.1 included a kernel fix on November 1 for x86 devices.

What Lightning Labs changed

Peter Todd advised people running LND on Linux with open ports to shut their Bitcoin Lightning nodes down until the kernel was patched or otherwise mitigated.

The demonstrated exploit path uses a Multipath TCP listener, called MPTCP. Go 1.24 and later enable MPTCP by default. Because LND is written in Go, recent versions were listening with MPTCP on their peer, gRPC and REST ports when the kernel had the feature enabled.

Both emergency LND releases disable MPTCP listeners by default. Lightning Labs described the change as a mitigation, not a fix. Olaoluwa Osuntokun and the official Lightning Labs account recommended the update.

Patch status for Linux systems

Canonical made fixed kernels available in the proposed pocket for Ubuntu 22.04, 24.04 and 26.04. They have not yet reached the regular updates channel.

Debian, Amazon Linux and others had already released patches earlier. UmbrelOS 2.0.1 applied a traffic-blocking mitigation on Raspberry Pi, where a fixed kernel was not yet available.

Other services on the same machine remain exposed until MPTCP is disabled host-wide or the kernel is updated. Only a patched kernel fully resolves the underlying issue.

Scanning reports and what is confirmed

Security researcher Marcus Hutchins later reported internet-wide scanning activity consistent with threat actors looking for exposed systems. His scans found roughly 2.1 million servers reachable over MPTCP on port 443. International Cyber Digest amplified the finding on November 4 and noted the scanning and Ubuntu's slower patch timeline.

No confirmed in-the-wild exploitation has been reported. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog. Anthropic's remote-root demonstration remains unpublished.

Anthropic's Frontier Red Team showed the bug could be turned into a remote root exploit against systems exposing an MPTCP listener.

Who is most exposed

The practical exposure is highest on internet-facing servers. Home desktop systems behind typical NAT and firewalls, without public TCP listeners, are far less affected.

For Lightning operators on Linux, the LND releases remove the specific MPTCP listener path used in the public exploit demonstration. The broader kernel bug remains until a patched kernel is installed.

Sources

• Bitcoin Magazine