Bitcoin Lightning operators operating an affected, unpatched Linux kernel stay uncovered to a important vulnerability after upgrading LND, the software program used to function their fee nodes.
Its October 30 releases, v0.20.7-beta and v0.21.6-beta, disable Multipath TCP, or MPTCP, listeners by default. That closes the demonstrated CVE-2026-98432 route via these listeners. It leaves the kernel flaw in place and doesn’t cowl different companies on the identical machine.
One other uncovered MPTCP service on the identical unpatched machine can protect the demonstrated route, even after LND’s default listeners have modified.
Why the LND replace has limits
The flaw entails freed reminiscence getting used throughout IPv4 TCP connection dealing with in Linux and might permit an attacker to run code on an affected host. Ubuntu assigns it a important CVSS 3.1 rating of 9.8.
LND’s operator notes say Go 1.24 and later enabled MPTCP listeners by default on Linux, which LND 0.21.x consequently uncovered on its peer, gRPC and REST ports. These embody the node’s connections to different nodes and its software interfaces.
The Go Safety Staff’s advisory explains why that change can not end the job. The demonstrated exploit requires an uncovered MPTCP listener, however the kernel bug is broader. Comparable assaults in opposition to methods with out MPTCP listeners could also be potential; the advisory doesn’t set up a demonstrated non-MPTCP exploit.
Go additionally warns that disabling MPTCP one program at a time is fragile. A single remaining uncovered listener leaves the system susceptible to that route, and express socket settings can override Go’s default configuration.
The advisories describe a demonstrated Linux exploit, not proof that attackers used this flaw in opposition to LND nodes or stole Bitcoin.
CryptoSlate beforehand coated the identical CVE’s implications for Solana validators. The Core Lightning channel and remote-command fixes reported November 6 concern separate software flaws.
The Ubuntu tracker, checked November 9 and final up to date November 7, nonetheless labeled the usual linux package deal for Ubuntu 24.04 LTS susceptible, with work in progress in 6.8.0-149.149. Its Ubuntu 22.04 LTS entry carried the identical standing for five.15.0-203.213.
Patch availability varies by package deal. In its November 2 advisory, Canonical stated kernel fixes for this CVE had been out there within the -proposed repository for customers who run their very own kernel acceptance checks, whereas qualification testing continued.
Ubuntu’s work-in-progress e-newsletter for November 1–7 additionally stated some releases, together with 24.04, had superior to -updates. That broader observe doesn’t determine each kernel variant. Operators due to this fact must examine the out there replace for his or her precise kernel package deal slightly than infer availability from the Ubuntu launch identify alone.
The tracker illustrates the excellence: it lists the usual Ubuntu 26.10 linux package deal as fastened in 7.3.0-10.10, whereas cloud, hardware-enablement and different kernel variants have separate entries. A hard and fast standing for one package deal can not settle the standing of one other.
Safety nonetheless requires work on the host
LND maintainers advocate upgrading the applying, disabling MPTCP on the host, and putting in a patched kernel as quickly because the distribution makes one out there.
Cumulative host configurations
Cumulative host configurationsLND up to dateMPTCP offPatched kernel operating
Illustrative configuration: LND’s default MPTCP listeners are off, however one other service nonetheless exposes one on an unpatched host.
With MPTCP disabled throughout related community namespaces, the demonstrated route is closed. The underlying kernel flaw stays.
After a patched kernel is put in and booted, this kernel flaw is repaired. The diagram retains the previous MPTCP mitigation.
Improve LND, tackle different MPTCP listeners and community namespaces, then set up and boot a patched kernel.
Illustrative configurations, not checks of a stay node or a document of assaults. Disabling MPTCP covers the demonstrated route solely; the bug is broader. The disabled state assumes related community namespaces are coated. Different vulnerabilities are exterior scope.
Their steerage makes use of sudo sysctl -w internet.mptcp.enabled=0 for the host setting, with a persistent configuration to retain it. The setting applies per community namespace, so Docker deployments want separate consideration to the container’s community configuration. Altering the host alone will not be an alternative to checking that scope.
Operators who can not improve LND instantly can begin their present binary with GODEBUG=multipathtcp=0 to disable Go’s default MPTCP listeners. Maintainers warn in opposition to re-enabling that default earlier than patching the kernel.
Canonical advises checking the kernel really operating with uname -r. After putting in its kernel safety replace, a reboot is required. An upgraded LND binary and an put in kernel package deal are completely different milestones; finishing the operating-system restore requires operating the patched kernel.
