{"id":247692,"date":"2026-11-04T18:31:56","date_gmt":"2026-11-04T18:31:56","guid":{"rendered":"https:\/\/mycryptomania.com\/?p=247692"},"modified":"2026-11-04T18:31:56","modified_gmt":"2026-11-04T18:31:56","slug":"matt-corallo-flags-critical-linux-kernel-flaw-lightning-labs-ships-lnd-mitigation","status":"publish","type":"post","link":"https:\/\/mycryptomania.com\/?p=247692","title":{"rendered":"Matt Corallo Flags Critical Linux Kernel Flaw; Lightning Labs Ships LND Mitigation"},"content":{"rendered":"

Bitcoin Magazine<\/a><\/p>\n

Matt Corallo Flags Critical Linux Kernel Flaw; Lightning Labs Ships LND Mitigation<\/a><\/p>\n

<\/div>\n

Bitcoin Core and Lightning developer Matt Corallo<\/a> highlighted a severe Linux kernel vulnerability on October 30, criticizing Ubuntu\u2019s delayed response to what he called \u201cthe most critical Linux vuln ever.\u201d The bug, tracked as CVE-2026-98432<\/a>, affects the kernel\u2019s IPv4 TCP handshake code with a CVSS severity score of 9.8. Anthropic\u2019s Frontier Red Team later showed<\/a> it could be turned into a remote root exploit against systems exposing a Multipath TCP (MPTCP) listener.<\/p>\n

Peter Todd<\/a> echoed the warning the same day, advising anyone running LND on Linux with open ports to shut their Bitcoin Lightning nodes down until the kernel was patched or otherwise mitigated. The demonstrated exploit path relies on an MPTCP listener\u2014something Go 1.24 and later enable by default. Because LND is written in Go<\/a>, recent versions were listening with MPTCP on their peer, gRPC, and REST ports whenever the kernel had the feature enabled.<\/p>\n

Lightning Labs responded the same day with emergency releases: lnd v0.21.6-beta<\/a> and the backport v0.20.7-beta<\/a>. Both disable MPTCP listeners by default, closing the demonstrated exploit path through LND. The project described the change as a mitigation, not a fix, and noted that only a patched kernel fully resolves the underlying issue. Other services on the same machine remain exposed until MPTCP is disabled host-wide or the kernel is updated. Olaoluwa Osuntokun<\/a> and the official Lightning Labs<\/a> account both recommended the update.<\/p>\n

Security researcher Marcus Hutchins<\/a> later reported internet-wide scanning activity consistent with threat actors looking for exposed systems. His scans found roughly 2.1 million servers reachable over MPTCP on port 443. International Cyber Digest<\/a> amplified the finding on November 4, noting the scanning and Ubuntu\u2019s slower patch timeline.\u00a0<\/p>\n

Canonical has since made fixed kernels available in the opt-in, proposed pocket for Ubuntu 22.04, 24.04, and 26.04, but they have not yet reached the regular updates channel. Red Hat shipped fixes for RHEL 8\/9\/10 on November 1; Debian, Amazon Linux, and others had already released patches earlier.<\/p>\n

UmbrelOS 2.0.1<\/a> included the kernel fix on November 1st for x86 devices and applied a traffic-blocking mitigation on Raspberry Pi, where a fixed kernel was not yet available. No confirmed in-the-wild exploitation has been reported, and the vulnerability has not been added to CISA\u2019s Known Exploited Vulnerabilities catalog. Anthropic\u2019s remote-root demonstration remains unpublished.<\/p>\n

The practical exposure is highest on internet-facing servers. Home desktop systems behind typical NAT and firewalls, without public TCP listeners, are far less affected. For Lightning operators on Linux, the LND releases remove the specific MPTCP listener path the public exploit used, but the broader kernel bug remains until a patched kernel is installed.<\/p>\n

This post Matt Corallo Flags Critical Linux Kernel Flaw; Lightning Labs Ships LND Mitigation<\/a> first appeared on Bitcoin Magazine<\/a> and is written by Juan Galt<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

Bitcoin Magazine Matt Corallo Flags Critical Linux Kernel Flaw; Lightning Labs Ships LND Mitigation Bitcoin Core and Lightning developer Matt Corallo highlighted a severe Linux kernel vulnerability on October 30, criticizing Ubuntu\u2019s delayed response to what he called \u201cthe most critical Linux vuln ever.\u201d The bug, tracked as CVE-2026-98432, affects the kernel\u2019s IPv4 TCP handshake […]<\/p>\n","protected":false},"author":0,"featured_media":247693,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-247692","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-discovery"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/247692"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=247692"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/247692\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/media\/247693"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=247692"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=247692"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=247692"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}