Bitcoin Lightning Security Update Blocks CVE-2026-98432, Linux Kernel Flaw Remains

LND released v0.20.7-beta and v0.21.6-beta on October 30 with MPTCP listeners disabled by default. The change blocks the demonstrated CVE-2026-98432 attack route through those listeners but does not repair the Linux kernel vulnerability or protect other services. Lightning operators using affected, unpatched kernels therefore remain exposed after updating LND, the software that runs the operators' payment nodes. Another exposed MPTCP service on the same machine can keep the demonstrated attack route open.

The vulnerability involves use-after-free memory handling in Linux IPv4 TCP connections and can let an attacker execute code on an affected host. Ubuntu rates the flaw as critical, with a CVSS 3.1 score of 9.8. LND's operator notes explain that Go versions starting with 1.24 enabled Linux MPTCP listeners by default. The notes say LND 0.21.x consequently exposed MPTCP on the peer, gRPC and REST ports used for node connections and application interfaces.

The Go Security Team's advisory says the demonstrated exploit needs an exposed MPTCP listener, while the underlying kernel defect has broader scope. The advisory says similar attacks may be possible without MPTCP listeners, but does not establish a demonstrated exploit against systems without those listeners. Go warns that disabling MPTCP separately in each program is fragile because one remaining exposed listener preserves the demonstrated route. Go also warns that explicit socket settings can override the defaults. The advisories document a demonstrated Linux exploit, not evidence of attacks against LND nodes or Bitcoin theft. The Core Lightning fixes reported on November 6 address separate channel and remote-command vulnerabilities.

The Ubuntu tracker, reviewed on November 9 after a November 7 update, still marked the standard linux package for Ubuntu 24.04 LTS as vulnerable. The tracker listed work in progress for that package in version 6.8.0-149.149. The Ubuntu 22.04 LTS entry likewise remained vulnerable, with work in progress in 5.15.0-203.213. Canonical's November 2 advisory said fixes were available through the -proposed repository for users conducting kernel acceptance tests while qualification testing continued.

Ubuntu's November 1-7 work-in-progress newsletter said some releases, including 24.04, had progressed to -updates. However, the newsletter did not specify every kernel variant. Operators must therefore verify the update available for the exact kernel package rather than rely solely on the Ubuntu release name. The tracker marks the standard Ubuntu 26.10 linux package as fixed in 7.3.0-10.10. Cloud, hardware-enablement and other kernel variants have individual tracker entries, so one package's fixed status does not establish another package's status.

LND maintainers recommend updating LND, turning off MPTCP at host level and installing a repaired kernel as soon as the distribution provides one. The maintainers specify the command sudo sysctl -w net.mptcp.enabled=0 and recommend persistent configuration to preserve the setting. The setting operates separately within each network namespace, so Docker operators must also examine container network configuration. A host-level change alone does not replace that check. Operators unable to update LND immediately can launch the existing binary with GODEBUG=multipathtcp=0 to turn off Go's default MPTCP listeners. Maintainers warn operators not to restore that default before repairing the kernel.

Canonical recommends using uname -r to identify the kernel currently running. Canonical requires a reboot after installation of the kernel security update. Updating LND and installing a kernel package are separate steps, and the operating-system repair is complete only when the patched kernel is running.