When Matt Corallo called CVE-2026-98432 'the most critical Linux vuln ever' on October 30, he wasn't exaggerating. A CVSS severity score of 9.8 paired with Anthropic's Frontier Red Team demonstration of a remote root exploit against systems with Multipath TCP listeners represents exactly the kind of vulnerability that keeps infrastructure operators awake at night. The fact that Peter Todd advised anyone running LND on Linux with open ports to shut their nodes down the same day underscores just how urgent the threat was. But here's what deserves scrutiny: Lightning Labs moved fast, and other vendors moved fast. Ubuntu did not.
Lightning Labs shipped emergency releases—lnd v0.21.6-beta and v0.20.7-beta—on the same day the vulnerability was publicly flagged, disabling MPTCP listeners by default to close the demonstrated exploit path through LND. Olaoluwa Osuntokun and the official Lightning Labs account recommended the update immediately. Red Hat delivered RHEL 8/9/10 kernel fixes on November 1. Debian, Amazon Linux, and others had already patched earlier. Even UmbrelOS pushed a kernel fix for x86 devices on November 1, with a traffic-blocking mitigation for Raspberry Pi systems where a fixed kernel wasn't yet available. This is how infrastructure security is supposed to work.
Canonical's response? Fixed kernels landed in the opt-in 'proposed' pocket for Ubuntu 22.04, 24.04, and 26.04—but not in the regular updates channel where most users actually receive patches. As of the report's writing, Ubuntu users relying on automatic security updates still weren't protected. Meanwhile, Marcus Hutchins documented internet-wide scanning activity consistent with threat actors hunting for exposed systems, discovering roughly 2.1 million servers reachable over MPTCP on port 443. The window of vulnerability is not theoretical.
To be fair to Lightning Labs, the company was transparent: the LND updates are a mitigation, not a fix. They close one exploit path but leave the underlying kernel bug intact on systems that don't patch. Other services on the same machine remain exposed until MPTCP is disabled host-wide or the kernel is updated. The onus is ultimately on users to apply kernel patches—but only if their distributor makes those patches available through their regular update channels.
No confirmed in-the-wild exploitation has been reported yet, and Anthropic's remote-root demonstration remains unpublished, which suggests responsible disclosure is holding. But Canonical's delayed timeline for regular updates is indefensible. A CVSS 9.8 vulnerability with active scanning and a public mitigation path demands faster distribution than Canonical is currently providing. Ubuntu users deserve kernel patches in their standard update channel, not buried in a proposed pocket they have to actively opt into. Speed matters when threat actors are already scanning for targets.