Matt Corallo Flags Critical Linux Kernel Flaw; Lightning Labs Ships LND Mitigation

Matt Corallo, a Bitcoin Core and Lightning developer, flagged a severe Linux kernel vulnerability on October 30, calling it "the most critical Linux vuln ever." The bug, tracked as CVE-2026-98432, affects the kernel's IPv4 TCP handshake code and carries a CVSS severity score of 9.8.

Anthropic's Frontier Red Team demonstrated the vulnerability could become a remote root exploit against systems exposing a Multipath TCP (MPTCP) listener. Peter Todd warned the same day that anyone running LND on Linux with open ports should shut down their Lightning nodes until the kernel was patched or mitigated.

The exploit path relies on MPTCP listeners, which Go 1.24 and later enable by default. Since LND is written in Go, recent versions were listening with MPTCP on peer, gRPC, and REST ports whenever the kernel had the feature enabled.

Lightning Labs released emergency patches the same day: lnd v0.21.6-beta and v0.20.7-beta. Both disable MPTCP listeners by default, blocking the demonstrated exploit path through LND. The company described the change as a mitigation, not a fix. Olaoluwa Osuntokun and Lightning Labs recommended the update.

Security researcher Marcus Hutchins reported internet-wide scanning activity consistent with threat actors searching for exposed systems. His scans found roughly 2.1 million servers reachable over MPTCP on port 443.

Red Hat shipped fixes for RHEL 8/9/10 on November 1. Canonical made fixed kernels available in the opt-in proposed pocket for Ubuntu 22.04, 24.04, and 26.04, but they have not yet reached the regular updates channel. Debian, Amazon Linux, and others had already released patches earlier. UmbrelOS 2.0.1 included the kernel fix on November 1st for x86 devices and applied a traffic-blocking mitigation on Raspberry Pi.

No confirmed in-the-wild exploitation has been reported, and CISA has not added the vulnerability to its Known Exploited Vulnerabilities catalog. Anthropic's demonstration remains unpublished. Home systems behind typical NAT and firewalls without public TCP listeners face lower practical exposure.