Lightning Labs flips off MPTCP default to close Linux attack route into LND

Lightning Labs shipped LND v0.20.7-beta and v0.21.6-beta, flipping Multipath TCP off by default to shut a demonstrated attack route into Lightning nodes running unpatched Linux kernels. The releases mitigate CVE-2026-98432, a flaw in how Linux handles IPv4 TCP connections that Ubuntu rates as critical at 9.8. Anthropic said its proof-of-concept exploit let a remote attacker run commands with root privileges on a Linux server with an MPTCP listener — no credentials, no user interaction required. Windows and macOS machines are not affected.

LND is the software Lightning operators use to run nodes, manage payment channels and move payments. CTO Olaoluwa Osuntokun announced the updates on Oct. 30 with a blunt recommendation: “We recommend that all users update to this new version.” The fix reverses an inherited default rather than repairing the operating system itself.

Here's how an MPTCP listener ended up on Lightning nodes in the first place. The Go Security Team says Go programs have enabled MPTCP for listening sockets on Linux by default since Go 1.24, and LND's maintainers say that kicks in whenever the host supports it — even though LND never explicitly configures MPTCP. Release notes for v0.20.7 and v0.21.6 flag earlier 0.20.x and 0.21.x builds as exposing MPTCP listeners on their peer, gRPC and REST ports. The new binaries put plain TCP back as the default.

Operators who can't upgrade right now have options. They can start their existing LND binary with the environment variable GODEBUG=multipathtcp=0 and restart the process — no rebuild needed, according to the maintainers' instructions. The release notes also tell Linux operators to kill MPTCP on the host with sudo sysctl -w net.mptcp.enabled=0 and make that setting stick. After restarting, a quick sudo ss -Mlnp | grep lnd should return nothing.

One caveat matters here: this is a mitigation, not a cure. Disabling MPTCP removes the prerequisite for the demonstrated exploit, but the underlying kernel bug stays put. The Go Security Team warns that systems without MPTCP listeners may still be vulnerable to similar attacks, and that a single exposed listener leaves a machine open — so installing a patched kernel remains necessary. Operators shouldn't re-enable MPTCP until they do. The LND update also does nothing for other services sharing the same box, and because the setting applies per network namespace, Docker users need to follow the container-specific steps in the release notes.

Lightning isn't the only network on notice. The same flaw prompted Anza to warn Solana validators, according to The Defiant. And Linux users are still waiting on the real fix: Ubuntu's tracker, updated Nov. 4, listed its main kernel packages for Ubuntu 22.04, 24.04, 26.04 and 26.10 as vulnerable, with fixes still in progress.