Lightning Labs issued emergency releases lnd v0.21.6-beta and the backport v0.20.7-beta on October 30. Both releases turn off Multipath TCP (MPTCP) listeners by default, blocking the demonstrated route for remotely obtaining root access through LND. The underlying vulnerability, CVE-2026-98432, affects IPv4 TCP handshake processing in the Linux kernel and carries a CVSS score of 9.8.
Bitcoin Core and Lightning developer Matt Corallo drew attention to the vulnerability on October 30. Corallo criticized Ubuntu's slow response and described the bug as "the most critical Linux vuln ever." Anthropic's Frontier Red Team subsequently demonstrated a remote root exploit against systems with an exposed MPTCP listener.
Peter Todd warned on October 30 that operators running LND on Linux with open ports should shut down Bitcoin Lightning nodes until a kernel patch or mitigation was applied. The demonstrated attack requires an MPTCP listener, which Go versions 1.24 and later enable by default. Recent LND versions, written in Go, therefore used MPTCP listeners for peer, gRPC and REST ports when the kernel supported the feature.
Lightning Labs characterized the releases as mitigation rather than a complete fix. Lightning Labs said a patched kernel is necessary to resolve the underlying vulnerability fully. Other services running on the machine remain exposed until MPTCP is disabled across the host or the kernel receives an update. Olaoluwa Osuntokun and Lightning Labs both recommended installing the LND update.
Security researcher Marcus Hutchins later reported scanning across the internet that was consistent with attackers searching for vulnerable systems. Hutchins found approximately 2.1 million servers accessible through MPTCP on port 443. International Cyber Digest publicized the finding on November 4, highlighting the scanning activity and Ubuntu's slower patch schedule.
Canonical has provided fixed kernels for Ubuntu 22.04, 24.04 and 26.04 through the opt-in proposed pocket. However, the fixed kernels have not reached Ubuntu's regular updates channel. Red Hat released patches for RHEL 8/9/10 on November 1. Debian, Amazon Linux and other distributions had issued patches earlier.
UmbrelOS 2.0.1 delivered the kernel patch for x86 devices on November 1. UmbrelOS applied a traffic-blocking mitigation to Raspberry Pi devices because a patched kernel was not yet available. No exploitation in the wild has been confirmed. CISA has not listed the vulnerability in the Known Exploited Vulnerabilities catalog. Anthropic has not published the remote root demonstration.
Servers accessible from the internet face the greatest practical exposure. Home desktops without public TCP listeners, protected by typical NAT and firewalls, are affected much less. The LND releases eliminate the demonstrated MPTCP listener route for Linux Lightning operators, but the broader vulnerability persists until operators install a patched kernel.
Bitcoin Lightning Nodes Urged to Disable MPTCP Due to Critical Linux Kernel Vulnerability
FLASH AIShare
Summary
Bitcoin news: A critical Linux kernel vulnerability, CVE-2026-98432, puts Bitcoin Lightning nodes at risk of remote root access. Lightning Labs released lnd v0.21.6-beta and v0.20.7-beta on October 30 to disable MPTCP by default. Security researcher Marcus Hutchins identified 2.1 million exposed servers using MPTCP on port 443. Canonical and Red Hat have issued patched kernels, but they are not yet in standard updates. Users are urged to update LND and apply patches to resolve the vulnerability news.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.