Matt Corallo flagged Linux kernel vulnerability CVE-2026-98432 on October 30, and Lightning Labs shipped LND 0.20.7, a release that closes the demonstrated exploit path through Lightning nodes. If you run LND on Linux, there are three steps to take, in order.
What CVE-2026-98432 is
The bug affects the Linux kernel's IPv4 TCP handshake code and carries a CVSS score of 9.8. Corallo called it on X "the most critical Linux vuln ever".
According to the LND 0.20.7 release notes, the demonstrated remote exploit requires a Multipath TCP (MPTCP) listener. Go 1.24+ enables MPTCP by default, so LND 0.20.x exposed such listeners on its peer, gRPC and REST ports. Windows and macOS are not affected.
What Lightning Labs changed
- LND 0.20.7 binaries no longer open MPTCP listeners and restore plain TCP as the default transport
- The change is a mitigation, not a fix: the kernel bug is not specific to MPTCP
- The official Lightning Labs account recommended the update
on X
- Once your kernel is patched, you can opt back into MPTCP with GODEBUG=multipathtcp=1
The three steps, in order
Lightning Labs asks Linux operators to do all three steps in this order. The new release protects LND only, not other services on the same machine.
Step | Action | What it covers |
|---|---|---|
1 | Upgrade to LND 0.20.7 | Closes the demonstrated exploit path through LND |
2 | sudo sysctl -w net.mptcp.enabled=0 | Other services on the host |
3 | Install your distribution's patched kernel | The only fix for the kernel bug itself |
To make step 2 persist across reboots, also run: echo 'net.mptcp.enabled = 0' | sudo tee /etc/sysctl.d/90-disable-mptcp.conf. If the command reports that the key does not exist, your kernel has no MPTCP support and is not exposed through this path.
Docker, verification and fallbacks
The MPTCP setting is per network namespace. If LND runs in Docker, pass --sysctl net.mptcp.enabled=0 to the container, or use the firewall rule in issue 11455, which covers all namespaces.
Verify with sudo ss -Mlnp | grep lnd - the command should print nothing. If you cannot upgrade yet, start the existing binary with GODEBUG=multipathtcp=0 instead.
Disabling MPTCP closes the demonstrated exploit only. Do not re-enable MPTCP with GODEBUG=multipathtcp=1 until your kernel is patched.