Bitcoin Core and Lightning Network developer Matt Corallo drew attention to a severe Linux kernel vulnerability on October 30, criticizing Ubuntu's delayed response to what he called “the most critical Linux vuln ever.” The bug, tracked as CVE-2026-98432, affects the kernel's IPv4 TCP handshake code and carries a CVSS severity score of 9.8, placing it in the critical band of the Common Vulnerability Scoring System, whose scale tops out at 10. Anthropic's Frontier Red Team subsequently demonstrated that it can be developed into a remote root exploit against systems exposing a Multipath TCP (MPTCP) listener—a kernel networking feature that lets a single TCP connection run over multiple network paths simultaneously.

Peter Todd echoed the warning the same day, urging anyone running LND on Linux with open ports to shut down their Bitcoin Lightning nodes until the kernel was patched or otherwise mitigated. The demonstrated exploit path relies on an MPTCP listener—something Go 1.24 and later enable by default, a language-level default that extends across the Go ecosystem rather than being specific to Bitcoin software. Because LND is written in Go, recent versions were listening with MPTCP on their peer, gRPC, and REST ports whenever the kernel had the feature enabled.

Lightning Labs responded with emergency releases the same day: lnd v0.21.6-beta and a backport, v0.20.7-beta. Both disable MPTCP listeners by default, closing the demonstrated exploit path through LND, according to the project's release notes. The change was characterized as a mitigation rather than a fix, with the project noting that only a patched kernel fully resolves the underlying issue. Other services on the same machine remain exposed until MPTCP is disabled host-wide or the kernel is updated. Olaoluwa Osuntokun and the official Lightning Labs account both recommended installing the update.

Security researcher Marcus Hutchins later reported internet-wide scanning activity consistent with threat actors searching for exposed systems. His scans identified roughly 2.1 million servers reachable over MPTCP on port 443, the standard port for HTTPS traffic. International Cyber Digest amplified the finding on November 4, highlighting both the scanning activity and Ubuntu's slower patch timeline.

Canonical has since made fixed kernels available in the opt-in proposed pocket—Ubuntu's staging area where packages receive testing before wider release—for Ubuntu 22.04, 24.04, and 26.04, though they have not yet reached the regular updates channel. Red Hat shipped fixes for RHEL 8, 9, and 10 on November 1, while Debian, Amazon Linux, and other distributions had already released patches earlier.

UmbrelOS 2.0.1 included the kernel fix on November 1 for x86 devices and applied a traffic-blocking mitigation on Raspberry Pi, where a fixed kernel was not yet available. No confirmed in-the-wild exploitation has been reported, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog. Anthropic's remote-root demonstration remains unpublished.

Practical exposure is highest on internet-facing servers. Home desktop systems behind typical NAT and firewalls, without public TCP listeners, are far less affected. For Lightning operators on Linux, the new LND releases remove the specific MPTCP listener path used by the public exploit, but the broader kernel bug persists until a patched kernel is installed. The remaining markers to watch are Ubuntu's promotion of the fixed kernels from the proposed pocket to the regular updates channel, publication of Anthropic's remote-root demonstration, and whether the flaw is added to CISA's Known Exploited Vulnerabilities catalog.

This article first appeared on Bitcoin Magazine and is written by Juan Galt.