Matt Corallo Flags Severe Linux Kernel Vulnerability and LND Update

Developer Matt Corallo raised alarms on October 30 regarding a critical vulnerability in the Linux kernel IPv4 TCP handshake code, tracked as CVE-2026-98432. Corallo criticized Ubuntu for a delayed response to the issue, which carries a maximum CVSS severity score of 9.8. Researchers from Anthropic’s Frontier Red Team demonstrated that the flaw could be weaponized into a remote root exploit against systems utilizing a Multipath TCP listener.

Peter Todd supported the warning by advising node operators running LND on Linux with open ports to shut down their Lightning nodes until patches or mitigations were applied. The vulnerability is exploitable via MPTCP listeners, which are enabled by default in Go 1.24 and later versions. Because LND is built using Go, recent iterations were actively listening with MPTCP on their gRPC, REST, and peer ports whenever the host kernel permitted the feature.

Lightning Labs issued emergency updates on the same day, releasing lnd v0.21.6-beta and a backport version v0.20.7-beta. These updates disable MPTCP listeners by default to block the demonstrated attack vector. Both Olaoluwa Osuntokun and representatives from Lightning Labs urged operators to apply the update immediately, though the project clarified that the change serves as a mitigation rather than a full resolution. Host machines remain vulnerable across other services until the underlying kernel is updated or MPTCP is disabled globally.

Security researcher Marcus Hutchins observed widespread internet scanning activity searching for exposed systems, locating approximately 2.1 million servers reachable via MPTCP on port 443. Canonical has made fixed kernels available through the proposed channel for Ubuntu versions 22.04, 24.04, and 26.04, while Red Hat, Debian, and Amazon Linux released their respective patches earlier. UmbrelOS 2.0.1 incorporated the kernel fix for x86 devices and deployed a traffic-blocking workaround for Raspberry Pi units lacking an immediate kernel update. CISA has not added the flaw to its known exploited vulnerabilities catalog, and no actual attacks have been confirmed.

Emergency updates released for LND after developer Matt Corallo exposes critical Linux kernel flaw.

Why it matters

This security situation directly impacts internet-facing servers and Bitcoin Lightning node operators running on affected Linux distributions. While home desktop setups behind standard firewalls face minimal risk, public-facing infrastructure requires immediate attention through software updates and host-wide kernel mitigations to prevent unauthorized access.