Bitcoin Lightning updates close one attack vector, but a critical Linux kernel flaw (CVE‑2026‑98432) remains unpatched on many hosts.
Bitcoin Lightning node operators who have upgraded to the latest LND releases still face a critical security gap, according to a CryptoSlate report published on November 9. While the new LND binaries disable Multipath TCP (MPTCP) listeners by default—closing the specific attack route demonstrated in CVE‑2026‑98432—the underlying Linux kernel flaw remains unpatched on many hosts, keeping nodes vulnerable to remote code execution.
The October 30 LND releases (v0.20.7‑beta and v0.21.6‑beta) remove the default MPTCP listeners that Go 1.24 enabled on Linux. This change stops the demonstrated exploitation path that leveraged an MPTCP listener to trigger the kernel memory‑corruption bug. CryptoSlate notes that the fix is limited to LND’s own ports (peer, gRPC, and REST) and does not address other services that might still expose MPTCP on the same machine.
The flaw, tracked as CVE‑2026‑98432, involves freed memory being reused during IPv4 TCP handling and carries a CVSS 3.1 score of 9.8, classifying it as critical. Ubuntu’s security tracker still lists the standard kernel packages for 22.04 LTS and 24.04 LTS as vulnerable, with patches only available in the -proposed repository as of early November. Canonical has indicated that full kernel updates are forthcoming but advises operators to verify the exact kernel version running on their systems.
CryptoSlate outlines a three‑pronged mitigation approach: (1) upgrade to the latest LND binary, (2) disable MPTCP at the host level using the sysctl command `net.mptcp.enabled=0` (or set the Go environment variable `GODEBUG=multipathtcp=0` for immediate relief), and (3) apply the patched Ubuntu kernel once it reaches the -updates channel and reboot. Operators using Docker must also adjust the container’s network namespace settings, as host‑level changes do not automatically propagate to containers.
The next developments to monitor include Canonical’s release cadence for the kernel fix across all Ubuntu variants, any public disclosure of exploitation attempts against Lightning nodes, and potential upstream patches from the Linux kernel community that could address the vulnerability outside of distribution‑specific updates.
Discussion 0