LND’s October 30 update blocks a demonstrated attack route, but affected, unpatched Linux hosts still need a kernel fix and reboot.
Bitcoin Lightning operators running an affected, unpatched Linux kernel remain exposed to a critical vulnerability after upgrading LND, the software used to operate their payment nodes.
Its October 30 releases, v0.20.7-beta and v0.21.6-beta, disable Multipath TCP, or MPTCP, listeners by default. That closes the demonstrated CVE-2026-98432 route through those listeners. It leaves the kernel flaw in place and does not cover other services on the same machine.
Another exposed MPTCP service on the same unpatched machine can preserve the demonstrated route, even after LND’s default listeners have changed.
The flaw involves freed memory being used during IPv4 TCP connection handling in Linux and can allow an attacker to run code on an affected host. Ubuntu assigns it a critical CVSS 3.1 score of 9.8.
LND’s operator notes say Go 1.24 and later enabled MPTCP listeners by default on Linux, which LND 0.21.x consequently exposed on its peer, gRPC and REST ports. These include the node’s connections to other nodes and its application interfaces.
The Go Security Team’s advisory explains why that change cannot finish the job. The demonstrated exploit requires an exposed MPTCP listener, but the kernel bug is broader. Similar attacks against systems without MPTCP listeners may be possible; the advisory does not establish a demonstrated non-MPTCP exploit.
Go also warns that disabling MPTCP one program at a time is fragile. A single remaining exposed listener leaves the system vulnerable to that route, and explicit socket settings can override Go’s default configuration.
Source link
