Linux Kernel Vulnerability Triggered by Matt Corallo; LND Mitigation Released

On October 30, Bitcoin Core and Lightning developer Matt Corallo drew attention to a critical Linux kernel flaw, taking issue with Ubuntu's slow reaction to what he described as "the most critical Linux vuln ever." The vulnerability, designated CVE-2026-98432, impacts the kernel's IPv4 TCP handshake logic and carries a CVSS score of 9.8. Anthropic's Frontier Red Team later demonstrated that the bug can be leveraged for a remote root exploit on systems that expose a Multipath TCP (MPTCP) listener.

The same day, Peter Todd reinforced the warning, urging anyone operating LND on Linux with exposed ports to take their Bitcoin Lightning nodes offline until a kernel patch or alternative mitigation was applied. The attack vector shown publicly depends on an MPTCP listener, which Go 1.24 and newer versions enable by default. Since LND is built in Go, recent releases were listening on their peer, gRPC, and REST ports via MPTCP whenever the kernel supported the feature.

Lightning Labs acted swiftly that same day, pushing out emergency versions: lnd v0.21.6-beta and the backport v0.20.7-beta. Both releases disable MPTCP listeners by default, thereby closing the exploit path that had been demonstrated for LND. The team characterized the update as a mitigation rather than a full fix, emphasizing that only a patched kernel truly addresses the root cause. Other services on the same host remain at risk until MPTCP is turned off system-wide or the kernel gets patched. Olaoluwa Osuntokun and the official Lightning Labs account both advised users to apply the update.

Security researcher Marcus Hutchins subsequently reported widespread scanning across the internet, consistent with threat actors seeking vulnerable systems. His scans identified approximately 2.1 million servers accessible via MPTCP on port 443. On November 4, International Cyber Digest highlighted the finding, pointing out both the scanning activity and the relatively slower patch rollout from Ubuntu.

Canonical has since provided patched kernels in the opt-in "proposed" pocket for Ubuntu 22.04, 24.04, and 26.04, but these have not yet been pushed to the regular updates channel. Red Hat delivered fixes for RHEL 8/9/10 on November 1, while Debian, Amazon Linux, and other distributions had already released patches before that.

On November 1, UmbrelOS 2.0.1 incorporated the kernel fix for x86 devices and deployed a traffic-blocking workaround on Raspberry Pi, for which a patched kernel was not yet ready. No verified exploitation in the wild has been documented, and the vulnerability does not appear on CISA's Known Exploited Vulnerabilities catalog. Anthropic's remote-root proof-of-concept has not been released.

The greatest practical risk lies with internet-facing servers. Home desktop machines behind standard NAT and firewalls, lacking public TCP listeners, are much less vulnerable. For Lightning node operators on Linux, the LND updates eliminate the specific MPTCP listener path exploited in the public demo, yet the underlying kernel flaw persists until a patched kernel is put in place.