Lightning Labs Rushes Patches as a 9.8 Linux Bug Draws Scanners

Lightning Labs didn't wait for a kernel patch. The team pushed emergency releases of lnd — v0.21.6-beta plus a backport, v0.20.7-beta — that switch off MPTCP listeners by default, cutting the exact path the public exploit walked through. Lightning Labs is calling it a mitigation, not a cure: only a patched kernel fully closes the underlying hole, and anything else running on the same machine stays exposed until MPTCP is disabled host-wide or the kernel gets updated.

The bug is CVE-2026-98432, a flaw in the Linux kernel's IPv4 TCP handshake code rated 9.8 for severity. Bitcoin Core and Lightning developer Matt Corallo flagged it on October 30 and lit into Ubuntu's slow response, calling it “the most critical Linux vuln ever,” per Bitcoin Magazine. Anthropic's Frontier Red Team later showed it could be turned into a remote root exploit against systems exposing a Multipath TCP listener.

Peter Todd echoed the alarm the same day, telling anyone running LND on Linux with open ports to shut their Lightning nodes down until the kernel was patched or mitigated. The catch: Go 1.24 and later enable MPTCP by default, and LND is written in Go — so recent versions were listening with MPTCP on their peer, gRPC and REST ports whenever the kernel supported it. Olaoluwa Osuntokun and Lightning Labs' official account both urged operators to update.

The internet noticed fast. Security researcher Marcus Hutchins reported scanning activity consistent with threat actors hunting for exposed systems, finding roughly 2.1 million servers reachable over MPTCP on port 443. International Cyber Digest amplified that finding on November 4, pointing at both the scanning and Ubuntu's slower patch timeline.

Fixes are landing unevenly. Canonical has put patched kernels in the opt-in proposed pocket for Ubuntu 22.04, 24.04 and 26.04, but they haven't reached the regular updates channel yet. Red Hat shipped RHEL 8, 9 and 10 fixes on November 1, while Debian, Amazon Linux and others got out earlier. UmbrelOS 2.0.1 bundled the kernel fix for x86 devices on November 1 and applied a traffic-blocking workaround on Raspberry Pi, where no fixed kernel was ready.

Exposure is highest on internet-facing servers. Home desktops sitting behind typical NAT and firewalls, with no public TCP listeners, are far less affected. No confirmed in-the-wild exploitation has surfaced, the flaw isn't in CISA's Known Exploited Vulnerabilities catalog, and Anthropic's remote-root demonstration is still unpublished.