Lightning node operators running on Linux have been told to check their systems after a critical vulnerability in the Linux kernel's networking code turned out to have a direct path into LND, the most widely used Lightning Network implementation. Lightning Labs shipped emergency releases the same day the issue was flagged, but stresses that its update is a mitigation, not a cure.
The bug, tracked as CVE-2026-98432 and rated 9.8 out of 10 on the CVSS severity scale, sits in the part of the kernel that handles the IPv4 TCP handshake. On October 30, Bitcoin Core and Lightning developer Matt Corallo drew attention to it, calling it "the most critical Linux vuln ever" and criticising Ubuntu for being slow to ship a fix. Anthropic's Frontier Red Team later demonstrated that the flaw could be turned into a remote root exploit against any machine exposing a Multipath TCP (MPTCP) listener — in other words, an attacker on the internet could take full control of the server.
Why LND Was in the Firing Line
MPTCP is a networking extension that lets a single connection use several network paths at once. It is not something most Lightning operators would ever think about — but starting with Go 1.24, the Go programming language turns MPTCP listeners on by default. Because LND is written in Go, recent builds were quietly accepting MPTCP connections on their peer, gRPC and REST ports whenever the host kernel had the feature enabled.
That meant a Lightning node — software that, by design, keeps a hot wallet online and accepts connections from strangers — could be exactly the kind of exposed MPTCP listener the exploit needs. Developer Peter Todd went as far as advising anyone running LND on Linux with open ports to shut their nodes down until the kernel was patched or otherwise mitigated.
The Fix: lnd v0.21.6 and v0.20.7
Lightning Labs responded on October 30 with two emergency releases: lnd v0.21.6-beta and a backport for the older line, v0.20.7-beta. Both switch MPTCP listeners off by default, closing the specific route the demonstrated exploit used to reach LND. Lightning Labs co-founder Olaoluwa Osuntokun and the company's official account both urged operators to update.
The team was careful to frame the change as a mitigation rather than a fix. The underlying kernel bug is still there until the operating system is patched, and any other service on the same machine that listens with MPTCP remains exposed. The only complete remedy is a patched kernel — or disabling MPTCP across the whole host.
Patch Status Across Linux Distributions
Debian, Amazon Linux and several other distributions released patched kernels early, and Red Hat shipped fixes for RHEL 8, 9 and 10 on November 1. Canonical has published fixed kernels for Ubuntu 22.04, 24.04 and 26.04, but at the time of writing they were only available in the opt-in "proposed" pocket rather than the regular updates channel. On the node-in-a-box side, UmbrelOS 2.0.1 included the kernel fix for x86 devices on November 1 and applied a traffic-blocking workaround on Raspberry Pi, where a fixed kernel was not yet available.
The threat is not purely theoretical. Security researcher Marcus Hutchins reported internet-wide scanning consistent with attackers hunting for vulnerable systems, finding roughly 2.1 million servers reachable over MPTCP on port 443. So far, however, no confirmed in-the-wild exploitation has been reported, the bug has not been added to CISA's Known Exploited Vulnerabilities catalogue, and Anthropic's remote-root proof of concept has not been published.
What Node Runners Should Do
The risk is highest for internet-facing servers — VPS-hosted nodes and machines with public ports open. Home setups sitting behind a typical router NAT and firewall, with no public TCP listeners, are far less exposed. Either way, the advice is the same: upgrade LND to v0.21.6 or v0.20.7, then install a patched kernel as soon as your distribution makes one available. For Bitcoin's Lightning layer, it is another reminder that node security does not stop at the Bitcoin software itself — the operating system underneath holds the keys just as much.
05 November 2026
Country:
Global
Topic:
Security | Scaling