Matt Corallo Flags Critical Linux Kernel Flaw; Lightning Labs Ships LND Mitigation

Bitcoin Core and Lightning developer Matt Corallo highlighted a severe Linux kernel vulnerability on October 30, criticizing Ubuntu’s delayed response to what he called “the most critical Linux vuln ever.” The bug, tracked as CVE-2026-98432, affects the kernel’s IPv4 TCP handshake code with a CVSS severity score of 9.8. Anthropic’s Frontier Red Team later showed it could be turned into a remote root exploit against systems exposing a Multipath TCP (MPTCP) listener.

Peter Todd echoed the warning the same day, advising anyone running LND on Linux with open ports to shut their Bitcoin Lightning nodes down until the kernel was patched or otherwise mitigated. The demonstrated exploit path relies on an MPTCP listener—something Go 1.24 and later enable by default. Because LND is written in Go, recent versions were listening with MPTCP on their peer, gRPC, and REST ports whenever the kernel had the feature enabled.

Lightning Labs responded the same day with emergency releases: lnd v0.21.6-beta and the backport v0.20.7-beta. Both disable MPTCP listeners by default, closing the demonstrated exploit path through LND. The project described the change as a mitigation, not a fix, and noted that only a patched kernel fully resolves the underlying issue. Other services on the same machine remain exposed until MPTCP is disabled host-wide or the kernel is updated. Olaoluwa Osuntokun and the official Lightning Labs account both recommended the update.