Bitcoin Lightning operators who have upgraded to the latest LND releases remain exposed to a critical Linux kernel vulnerability if their host runs an affected, unpatched kernel, according to operator notes and security advisories. The October 30 releases, v0.20.7-beta and v0.21.6-beta, disable Multipath TCP (MPTCP) listeners by default, closing the demonstrated CVE-2026-98432 route through those listeners. However, the kernel flaw itself remains, and other services on the same machine are not covered.
Why the LND update has limits
The vulnerability involves freed memory being used during IPv4 TCP connection handling in Linux and can allow an attacker to run code on an affected host. Ubuntu assigns it a critical CVSS 3.1 score of 9.8. LND’s operator notes explain that Go 1.24 and later enabled MPTCP listeners by default on Linux, which LND 0.21.x consequently exposed on its peer, gRPC and REST ports—including connections to other nodes and application interfaces.
The Go Security Team’s advisory notes that while the demonstrated exploit requires an exposed MPTCP listener, the kernel bug is broader. Similar attacks against systems without MPTCP listeners may be possible, though the advisory does not establish a demonstrated non-MPTCP exploit. Go also warns that disabling MPTCP one program at a time is fragile: a single remaining exposed listener leaves the system vulnerable to that route, and explicit socket settings can override Go’s default configuration.
The advisories describe a demonstrated Linux exploit, not evidence that attackers used this flaw against LND nodes or stole Bitcoin. CryptoSlate previously covered the same CVE’s implications for Solana validators. The Core Lightning channel and remote-command fixes reported November 6 concern separate application flaws.
Patch status varies by kernel package
The Ubuntu tracker, checked November 9 and last updated November 7, still labeled the standard linux package for Ubuntu 24.04 LTS vulnerable, with work in progress in 6.8.0-149.149. Its Ubuntu 22.04 LTS entry carried the same status for 5.15.0-203.213. In its November 2 advisory, Canonical said kernel fixes for this CVE were available in the -proposed repository for users who run their own kernel acceptance tests, while qualification testing continued.
Ubuntu’s work-in-progress newsletter for November 1–7 also said some releases, including 24.04, had advanced to -updates. That broader note does not identify every kernel variant. Operators therefore need to check the available update for their exact kernel package rather than infer availability from the Ubuntu release name alone. The tracker illustrates the distinction: it lists the standard Ubuntu 26.10 linux package as fixed in 7.3.0-10.10, while cloud, hardware-enablement and other kernel variants have separate entries. A fixed status for one package cannot settle the status of another.
Protection still requires host-level action
LND maintainers recommend upgrading the application, disabling MPTCP on the host, and installing a patched kernel as soon as the distribution makes one available. Their guidance uses sudo sysctl -w net.mptcp.enabled=0 for the host setting, with a persistent configuration to retain it. The setting applies per network namespace, so Docker deployments need separate attention to the container’s network configuration. Changing the host alone is not a substitute for checking that scope.
Operators who cannot upgrade LND immediately can start their existing binary with GODEBUG=multipathtcp=0 to disable Go’s default MPTCP listeners. Maintainers warn against re-enabling that default before patching the kernel.
Canonical advises checking the kernel actually running with uname -r. After installing its kernel security update, a reboot is required. An upgraded LND binary and an installed kernel package are different milestones; completing the operating-system repair requires running the patched kernel.
