Bitcoin Lightning’s security update shuts one door. A critical Linux flaw remains

Bitcoin Lightning operators running an affected, unpatched Linux kernel remain exposed to a critical vulnerability after upgrading LND, the software used to operate their payment nodes.

Its October 30 releases, v0.20.7-beta and v0.21.6-beta, disable Multipath TCP, or MPTCP, listeners by default. That closes the demonstrated CVE-2026-98432 route through those listeners. It leaves the kernel flaw in place and does not cover other services on the same machine.

Another exposed MPTCP service on the same unpatched machine can preserve the demonstrated route, even after LND’s default listeners have changed.

The flaw involves freed memory being used during IPv4 TCP connection handling in Linux and can allow an attacker to run code on an affected host. Ubuntu assigns it a critical CVSS 3.1 score of 9.8.

LND’s operator notes say Go 1.24 and later enabled MPTCP listeners by default on Linux, which LND 0.21.x consequently exposed on its peer, gRPC and REST ports. These include the node’s connections to other nodes and its application interfaces.

The Go Security Team’s advisory explains why that change cannot finish the job. The demonstrated exploit requires an exposed MPTCP listener, but the kernel bug is broader. Similar attacks against systems without MPTCP listeners may be possible; the advisory does not establish a demonstrated non-MPTCP exploit.

Go also warns that disabling MPTCP one program at a time is fragile. A single remaining exposed listener leaves the system vulnerable to that route, and explicit socket settings can override Go’s default configuration.

The advisories describe a demonstrated Linux exploit, not evidence that attackers used this flaw against LND nodes or stole Bitcoin.

CryptoSlate previously covered the same CVE’s implications for Solana validators. The Core Lightning channel and remote-command fixes reported November 6 concern separate application flaws.

The Ubuntu tracker, checked November 9 and last updated November 7, still labeled the standard linux package for Ubuntu 24.04 LTS vulnerable, with work in progress in 6.8.0-149.149. Its Ubuntu 22.04 LTS entry carried the same status for 5.15.0-203.213.

Patch availability varies by package. In its November 2 advisory, Canonical said kernel fixes for this CVE were available in the -proposed repository for users who run their own kernel acceptance tests, while qualification testing continued.

Ubuntu’s work-in-progress newsletter for November 1–7 also said some releases, including 24.04, had advanced to -updates. That broader note does not identify every kernel variant. Operators therefore need to check the available update for their exact kernel package rather than infer availability from the Ubuntu release name alone.

The tracker illustrates the distinction: it lists the standard Ubuntu 26.10 linux package as fixed in 7.3.0-10.10, while cloud, hardware-enablement and other kernel variants have separate entries. A fixed status for one package cannot settle the status of another.

LND maintainers recommend upgrading the application, disabling MPTCP on the host, and installing a patched kernel as soon as the distribution makes one available.