Matt Corallo Alerts to Critical Linux Kernel Flaw; Lightning Labs Deploys LND Mitigation
On October 30, Bitcoin Core and Lightning developer Matt Corallo brought attention to a severe Linux kernel vulnerability, criticizing Ubuntu’s delayed response to what he labeled the most critical Linux flaw to date. The vulnerability, identified as CVE-2026-98432, targets the kernel’s IPv4 TCP handshake mechanism with a CVSS severity rating of 9.8. Anthropic’s Frontier Red Team subsequently demonstrated that the flaw could be weaponized into a remote root exploit on systems exposing a Multipath TCP (MPTCP) listener.
Peter Todd sounded an immediate warning on the same day, urging Bitcoin LND operators on Linux with open ports to suspend their Lightning nodes until the kernel received a patch or an appropriate mitigation was applied. The exploit leverages an MPTCP listener—a capability enabled by default in Go 1.24 and newer. Since LND is implemented in Go, recent releases were exposing MPTCP listeners on peer, gRPC, and REST ports whenever the kernel feature was active.
Lightning Labs issued emergency patches the same day, releasing lnd v0.21.6-beta and the backport v0.20.7-beta. Both versions disable MPTCP listeners by default, effectively blocking the exploit pathway that LND was relying on. The team characterized this change as a mitigation rather than a full fix, emphasizing that only a properly patched kernel will completely eliminate the underlying vulnerability. Other services on the same host stay exposed until MPTCP is globally disabled or the kernel is upgraded. Researchers Olaoluwa Osuntokun and the official Lightning Labs account both advised prompt adoption of the update.
Security researcher Marcus Hutchins later reported worldwide scanning activity indicating that threat actors were actively probing for exposed systems. His scans identified approximately 2.1 million servers accessible via MPTCP on port 443. International Cyber Digest highlighted the incident on November 4, drawing attention to both the scanning campaign and Ubuntu’s delayed patch rollout.
Canonical subsequently released corrected kernels through an optional, proposed channel for Ubuntu 22.04, 24.04, and 26.04, though these have not yet been promoted to the standard updates stream. Red Hat distributed fixes for RHEL 8/9/10 on November 1, while Debian, Amazon Linux, and additional distributions had already issued their own patches.
UmbrelOS 2.0.1 incorporated the kernel patch on November 1 for x86 hardware and also deployed a traffic-blocking mitigation on Raspberry Pi systems that lacked a kernel update. No confirmed real-world exploits have been documented, and the flaw has not been included in CISA’s Known Exploited Vulnerabilities catalog. Anthropic’s remote-root proof-of-concept remains unpublished.
The practical attack surface is most severe on internet-facing servers. Home desktops shielded by standard NAT and firewalls—lacking public TCP listeners—remain comparatively insulated. For Bitcoin LND operators running Linux, the recent LND releases eliminate the specific MPTCP listener that the public exploit leveraged, although the underlying kernel vulnerability persists until a corrected kernel is installed.