Emergency LND Updates Disable MPTCP Listeners

Lightning Labs has released emergency software updates for its Lightning Network Daemon (LND) to mitigate a critical security vulnerability in the Linux kernel. The new releases, lnd v0.21.6-beta and backport v0.20.7-beta, disable Multipath TCP (MPTCP) listeners by default, closing an exploit path identified in the kernel’s IPv4 TCP handshake code.

The underlying vulnerability, tracked as CVE-2026-98432, carries a Common Vulnerability Scoring System (CVSS) severity score of 9.8. Bitcoin Core and Lightning developer Matt Corallo highlighted the flaw on October 30, noting its potential to compromise systems running vulnerable kernel versions with exposed network ports.

Exploit Demonstration and Developer Warnings

Anthropic’s Frontier Red Team demonstrated that the vulnerability could be leveraged into a remote root exploit against systems exposing an MPTCP listener. This attack vector is particularly relevant for applications built with Go 1.24 and later, which enable MPTCP listeners by default.

Following Corallo’s disclosure, independent Bitcoin developer Peter Todd advised users running LND on Linux with open ports to shut down their nodes until the kernel was patched or mitigated. Lightning Labs responded the same day with the emergency releases, ensuring that the default configuration no longer exposes the vulnerable listener.

Scanning Activity and Patch Availability

Security researcher Marcus Hutchins reported internet-wide scanning activity consistent with threat actors searching for exposed systems. His scans identified approximately 2.1 million servers reachable over MPTCP on port 443, indicating a broad potential attack surface.

Distribution providers have begun rolling out fixes. Red Hat shipped patches for RHEL 8, 9, and 10 on November 1. Canonical made fixed kernels available in the opt-in proposed pocket for Ubuntu 22.04, 24.04, and 26.04, though these have not yet reached the regular updates channel. UmbrelOS 2.0.1 included the kernel fix for x86 devices on November 1 and applied a traffic-blocking mitigation for Raspberry Pi units where a fixed kernel was not yet available.

As of the latest reports, no confirmed in-the-wild exploitation of CVE-2026-98432 has been documented, and the vulnerability has not been added to the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog.