Bitcoin and Lightning developer Matt Corallo warned on October 30 about a severe Linux kernel vulnerability, criticizing Ubuntu’s response time. Tracked as CVE-2026-98432, the flaw affects IPv4 TCP handshake code and carries a CVSS score of 9.8. Anthropic’s Frontier Red Team later demonstrated that it could enable remote root access on systems with a Multipath TCP (MPTCP) listener.
That same day, Peter Todd urged people running LND on Linux with open ports to shut down their Lightning nodes until they could patch or mitigate the issue. The demonstrated attack relies on an MPTCP listener, which Go 1.24 and later enable by default. As LND is written in Go, recent versions could expose peer, gRPC, and REST ports to the vulnerable code when MPTCP was enabled in the kernel.
Lightning Labs released emergency updates: LND v0.21.6-beta and the backported v0.20.7-beta. Both disable MPTCP listeners by default, blocking the exploit path demonstrated through LND. The change is a mitigation, not a fix: updating the kernel is still necessary to address the underlying vulnerability, and other services on the same machine may remain exposed. Lightning Labs and developer Olaoluwa Osuntokun recommended installing the updates.
Security researcher Marcus Hutchins later reported scanning activity consistent with attackers searching for exposed systems. His scans identified about 2.1 million servers reachable over MPTCP on port 443. The finding was amplified on November 4, alongside reports that Ubuntu’s patch rollout was slower than some other distributions’.
Canonical has made fixed kernels available in the opt-in proposed updates for Ubuntu 22.04, 24.04, and 26.04, though they had not yet reached the regular updates channel. Red Hat issued fixes for RHEL 8, 9, and 10 on November 1; Debian, Amazon Linux, and other distributions had released patches earlier.
UmbrelOS 2.0.1, released November 1, included a kernel fix for x86 devices and a traffic-blocking mitigation for Raspberry Pi systems, which did not yet have a fixed kernel available.
No confirmed exploitation in the wild has been reported, and the vulnerability has not been added to CISA’s Known Exploited Vulnerabilities catalog. Anthropic has not published its remote-root demonstration.
Internet-facing servers face the greatest risk. Home computers behind typical routers and firewalls, with no public TCP listeners, are less exposed. For Linux Lightning operators, the LND updates close the specific MPTCP route used in the public demonstration, but the kernel flaw remains until the operating system is patched.
ChicagoVPS is your gateway to unparalleled hosting solutions. Our state-of-the-art datacenters and powerful network ensures lightning-fast speeds and uninterrupted connectivity for your websites and applications. Whether you’re a startup looking for scalable resources or an enterprise in need of enterprise-grade hosting, our range of plans and customizable solutions guarantee a perfect fit. Trust in ChicagoVPS to deliver excellence, combining unmatched reliability and top-tier support.
For Inquiries or to receive a personalized quote, please reach out to us through our contact form here or email us at sales@chicagovps.net.
