Bitcoin Magazine
Matt Corallo Flags Critical Linux Kernel Flaw; Lightning Labs Ships LND Mitigation
Bitcoin Core and Lightning developer Matt Corallo highlighted a severe Linux kernel vulnerability on October 30, criticizing Ubuntu’s delayed response to what he called “the most critical Linux vuln ever.” The bug, tracked as CVE-2026-98432, affects the kernel’s IPv4 TCP handshake code with a CVSS severity score of 9.8. Anthropic’s Frontier Red Team later showed it could be turned into a remote root exploit against systems exposing a Multipath TCP (MPTCP) listener.
Peter Todd echoed the warning the same day, advising anyone running LND on Linux with open ports to shut their Bitcoin Lightning nodes down until the kernel was patched or otherwise mitigated. The demonstrated exploit path relies on an MPTCP listener—something Go 1.24 and later enable by default. Because LND is written in Go, recent versions were listening with MPTCP on their peer, gRPC, and REST ports whenever the kernel had the feature enabled.
Lightning Labs responded the same day with emergency releases: lnd v0.21.6-beta and the backport v0.20.7-beta. Both disable MPTCP listeners by default, closing the demonstrated exploit path through LND. The project described the change as a mitigation, not a fix, and noted that only a patched kernel fully resolves the underlying issue. Other services on the same machine remain exposed until MPTCP is disabled host-wide or the kernel is updated. Olaoluwa Osuntokun and the official Lightning Labs account both recommended the update.
Security researcher Marcus Hutchins later reported internet-wide scanning activity consistent with threat actors looking for exposed systems. His scans found roughly 2.1 million servers reachable over MPTCP on port 443. International Cyber Digest amplified the finding on November 4, noting the scanning and Ubuntu’s slower patch timeline.
Canonical has since made fixed kernels available in the opt-in, proposed pocket for Ubuntu 22.04, 24.04, and 26.04, but they have not yet reached the regular updates channel. Red Hat shipped fixes for RHEL 8/9/10 on November 1; Debian, Amazon Linux, and others had already released patches earlier.
UmbrelOS 2.0.1 included the kernel fix on November 1st for x86 devices and applied a traffic-blocking mitigation on Raspberry Pi, where a fixed kernel was not yet available. No confirmed in-the-wild exploitation has been reported, and the vulnerability has not been added to CISA’s Known Exploited Vulnerabilities catalog. Anthropic’s remote-root demonstration remains unpublished.
The practical exposure is highest on internet-facing servers. Home desktop systems behind typical NAT and firewalls, without public TCP listeners, are far less affected. For Lightning operators on Linux, the LND releases remove the specific MPTCP listener path the public exploit used, but the broader kernel bug remains until a patched kernel is installed.
This post Matt Corallo Flags Critical Linux Kernel Flaw; Lightning Labs Ships LND Mitigation first appeared on Bitcoin Magazine and is written by Juan Galt.
About the Author
