Bitcoin Core and Lightning developer Matt Corallo highlighted a extreme Linux kernel vulnerability on October 30, criticizing Ubuntu’s delayed response to what he referred to as “essentially the most essential Linux vuln ever.” The bug, tracked as CVE-2026-98432, impacts the kernel’s IPv4 TCP handshake code with a CVSS severity rating of 9.8. Anthropic’s Frontier Purple Workforce later showed it could possibly be was a distant root exploit in opposition to techniques exposing a Multipath TCP (MPTCP) listener.
Peter Todd echoed the warning the identical day, advising anybody working LND on Linux with open ports to close their Bitcoin Lightning nodes down till the kernel was patched or in any other case mitigated. The demonstrated exploit path depends on an MPTCP listener—one thing Go 1.24 and later allow by default. As a result of LND is written in Go, latest variations have been listening with MPTCP on their peer, gRPC, and REST ports every time the kernel had the characteristic enabled.
Lightning Labs responded the identical day with emergency releases: lnd v0.21.6-beta and the backport v0.20.7-beta. Each disable MPTCP listeners by default, closing the demonstrated exploit path by way of LND. The mission described the change as a mitigation, not a repair, and famous that solely a patched kernel absolutely resolves the underlying subject. Different providers on the identical machine stay uncovered till MPTCP is disabled host-wide or the kernel is up to date. Olaoluwa Osuntokun and the official Lightning Labs account each beneficial the replace.
Safety researcher Marcus Hutchins later reported internet-wide scanning exercise according to risk actors on the lookout for uncovered techniques. His scans discovered roughly 2.1 million servers reachable over MPTCP on port 443. International Cyber Digest amplified the discovering on November 4, noting the scanning and Ubuntu’s slower patch timeline.
Canonical has since made fastened kernels accessible within the opt-in, proposed pocket for Ubuntu 22.04, 24.04, and 26.04, however they haven’t but reached the common updates channel. Purple Hat shipped fixes for RHEL 8/9/10 on November 1; Debian, Amazon Linux, and others had already launched patches earlier.
UmbrelOS 2.0.1 included the kernel repair on November 1st for x86 units and utilized a traffic-blocking mitigation on Raspberry Pi, the place a hard and fast kernel was not but accessible. No confirmed in-the-wild exploitation has been reported, and the vulnerability has not been added to CISA’s Identified Exploited Vulnerabilities catalog. Anthropic’s remote-root demonstration stays unpublished.
The sensible publicity is highest on internet-facing servers. House desktop techniques behind typical NAT and firewalls, with out public TCP listeners, are far much less affected. For Lightning operators on Linux, the LND releases take away the particular MPTCP listener path the general public exploit used, however the broader kernel bug stays till a patched kernel is put in.
