Bitcoin Core and Lightning developer Matt Corallo flagged a severe Linux kernel vulnerability on October 30. Tracked as CVE-2026-98432, the flaw affects the kernel’s IPv4 TCP handshake code and has a CVSS score of 9.8. Anthropic’s Frontier RED Team demonstrated a remote root exploit against systems with an exposed Multipath TCP (MPTCP) listener.

The exploit path is relevant to LND because Go 1.24 and later enable MPTCP listeners by default when the kernel supports the feature. Recent LND versions could therefore listen for peer, gRPC and REST connections over MPTCP. Peter Todd warned Linux users running LND with open ports to shut down their nodes until they had patched or otherwise mitigated the issue.

Lightning Labs issued lnd v0.21.6-beta and the backport v0.20.7-beta on October 30. Both disable MPTCP listeners by default, blocking the specific route demonstrated in the exploit. The project described the change as a mitigation rather than a fix: the underlying vulnerability requires a kernel update, and other services on the same machine may remain exposed unless MPTCP is disabled system-wide or the kernel is patched.

Security researcher Marcus Hutchins later reported scanning activity consistent with attempts to find exposed systems. His scans identified roughly 2.1 million servers reachable over MPTCP on port 443. No confirmed exploitation in the wild had been reported, and the vulnerability had not been added to CISA’s Known Exploited Vulnerabilities catalog. Anthropic’s remote-root demonstration remains unpublished.

Canonical has made fixed kernels available in the opt-in proposed pocket for Ubuntu 22.04, 24.04 and 26.04, but they had not reached the regular updates channel. Red Hat shipped fixes for RHEL 8, 9 and 10 on November 1; Debian, Amazon Linux and other distributions had released patches earlier. UmbrelOS 2.0.1 also included the kernel fix for x86 devices, while Raspberry Pi devices received a traffic-blocking mitigation because a fixed kernel was not yet available.

Internet-facing servers face the greatest exposure. Home desktops behind typical NAT and firewalls, without public TCP listeners, are less affected. For Linux Lightning operators, the LND releases close the demonstrated MPTCP route, but installing a patched kernel remains necessary to address the broader flaw.

Sources: Bitcoin Magazine.