Bitcoin Lightning operators working an affected, unpatched Linux kernel stay uncovered to a crucial vulnerability after upgrading LND, the software program used to function their fee nodes.
Its October 30 releases, v0.20.7-beta and v0.21.6-beta, disable Multipath TCP, or MPTCP, listeners by default. That closes the demonstrated CVE-2026-98432 route by way of these listeners. It leaves the kernel flaw in place and doesn’t cowl different companies on the identical machine.
One other uncovered MPTCP service on the identical unpatched machine can protect the demonstrated route, even after LND’s default listeners have modified.
Why the LND replace has limits
The flaw includes freed reminiscence getting used throughout IPv4 TCP connection dealing with in Linux and may enable an attacker to run code on an affected host. Ubuntu assigns it a crucial CVSS 3.1 rating of 9.8.
LND’s operator notes say Go 1.24 and later enabled MPTCP listeners by default on Linux, which LND 0.21.x consequently uncovered on its peer, gRPC and REST ports. These embody the node’s connections to different nodes and its utility interfaces.
The Go Safety Workforce’s advisory explains why that change can’t end the job. The demonstrated exploit requires an uncovered MPTCP listener, however the kernel bug is broader. Comparable assaults towards programs with out MPTCP listeners could also be attainable; the advisory doesn’t set up a demonstrated non-MPTCP exploit.
Go additionally warns that disabling MPTCP one program at a time is fragile. A single remaining uncovered listener leaves the system weak to that route, and specific socket settings can override Go’s default configuration.
The advisories describe a demonstrated Linux exploit, not proof that attackers used this flaw towards LND nodes or stole Bitcoin.
yourcryptonewstoday beforehand coated the identical CVE’s implications for Solana validators. The Core Lightning channel and remote-command fixes reported November 6 concern separate utility flaws.
The Ubuntu tracker, checked November 9 and final up to date November 7, nonetheless labeled the usual linux bundle for Ubuntu 24.04 LTS weak, with work in progress in 6.8.0-149.149. Its Ubuntu 22.04 LTS entry carried the identical standing for 5.15.0-203.213.
Patch availability varies by bundle. In its November 2 advisory, Canonical stated kernel fixes for this CVE have been accessible within the -proposed repository for customers who run their very own kernel acceptance exams, whereas qualification testing continued.
Ubuntu’s work-in-progress e-newsletter for November 1–7 additionally stated some releases, together with 24.04, had superior to -updates. That broader word doesn’t determine each kernel variant. Operators due to this fact must verify the accessible replace for his or her actual kernel bundle quite than infer availability from the Ubuntu launch identify alone.
The tracker illustrates the excellence: it lists the usual Ubuntu 26.10 linux bundle as fastened in 7.3.0-10.10, whereas cloud, hardware-enablement and different kernel variants have separate entries. A set standing for one bundle can’t settle the standing of one other.
Safety nonetheless requires work on the host
LND maintainers advocate upgrading the appliance, disabling MPTCP on the host, and putting in a patched kernel as quickly because the distribution makes one accessible.
Cumulative host configurations
Illustrative configuration: LND’s default MPTCP listeners are off, however one other service nonetheless exposes one on an unpatched host.
With MPTCP disabled throughout related community namespaces, the demonstrated route is closed. The underlying kernel flaw stays.
After a patched kernel is put in and booted, this kernel flaw is repaired. The diagram retains the previous MPTCP mitigation.
Improve LND, tackle different MPTCP listeners and community namespaces, then set up and boot a patched kernel.
Illustrative configurations, not exams of a stay node or a report of assaults. Disabling MPTCP covers the demonstrated route solely; the bug is broader. The disabled state assumes related community namespaces are coated. Different vulnerabilities are exterior scope.
Their steering makes use of sudo sysctl -w internet.mptcp.enabled=0 for the host setting, with a persistent configuration to retain it. The setting applies per community namespace, so Docker deployments want separate consideration to the container’s community configuration. Altering the host alone shouldn’t be an alternative choice to checking that scope.
Operators who can’t improve LND instantly can begin their current binary with GODEBUG=multipathtcp=0 to disable Go’s default MPTCP listeners. Maintainers warn towards re-enabling that default earlier than patching the kernel.
Canonical advises checking the kernel really working with uname -r. After putting in its kernel safety replace, a reboot is required. An upgraded LND binary and an put in kernel bundle are totally different milestones; finishing the operating-system restore requires working the patched kernel.
