Lightning Labs disables MPTCP listeners in lnd to close demonstrated Linux root path

Lightning Labs closes the MPTCP path

Lightning Labs shipped lnd v0.21.6-beta and the backport v0.20.7-beta on 30 October. Both disable Multipath TCP listeners by default, closing the demonstrated route for a remote attacker to gain root through LND. Lightning Labs called the change a mitigation, not a fix, and said only a patched kernel fully resolves the underlying issue.

Recent LND versions, written in Go, listened with MPTCP on their peer, gRPC and REST ports whenever the kernel supported the feature. Olaoluwa Osuntokun and the official Lightning Labs account both recommended the update. Peter Todd went further the same day: he advised operators running LND on Linux with open ports to shut their nodes down until a kernel patch or mitigation arrived.

Scanning raises urgency

Marcus Hutchins' scan on 30 October found about 2,102,043 servers reachable over MPTCP on port 443. A deeper TLS scan found about 762,774. Hutchins argues the higher figure is closer to the truth because a valid HTTP request is not needed to reach the code. The counts show exposure only and do not prove the kernels are unpatched, Cyber Security News reported.

Hutchins reported that residential proxies and Russia-based VPN servers began hitting port 443 with MPTCP connections as of 2 November. Normal scanners do not use MPTCP by default, so he strongly suspects the traffic targets CVE-2026-98432.

Go 1.24 and later request MPTCP for listening sockets by default when the kernel allows it, the Go Security Team said. The team also warned that the bug is not specific to MPTCP, so systems without those listeners may also be vulnerable. The lnd update closes the demonstrated path through LND. Other services on the same host remain reachable through that MPTCP path until MPTCP is disabled host-wide or the kernel is updated, Bitcoin Magazine reported. Canonical said disabling MPTCP alone is not enough because the flaw sits in the IPv4 TCP path.

The bug underneath

CVE-2026-98432 is a use-after-free in the kernel's IPv4 TCP handshake code. The Linux kernel's own CVE team rated it 9.8 out of 10. The bug has been present since Linux 4.4, and the upstream fix landed in October.

Anthropic's Frontier Red Team shared research on 27 October. It showed that an unreleased Claude model wrote an exploit letting a remote attacker with no credentials run commands as root against systems with an MPTCP listener. In the lab test, leaking a kernel address took 48 minutes and reaching a root shell took five more. A lost race fails only the handshake and does not crash the machine, so the attacker can retry. Anthropic said this was a lab test, not a real-world incident, and has not released the exploit.

Red Hat first rated the flaw Moderate at 5.9. Cyberkendra reported on 30 October that its CVE page then scored it 8.1, below the kernel team's 9.8, and its Bugzilla entry listed severity as urgent, with no new severity label published. In a November report, The Hacker News said Red Hat had raised the score to 9.8 and called it Critical.

Patch status

Red Hat shipped RHSA-2026:93414 for RHEL 8, RHSA-2026:93412 for RHEL 9 and RHSA-2026:93413 for RHEL 10 on 1 November. All require a reboot.

Canonical said on 2 November that fixes for Ubuntu 22.04 LTS, 24.04 LTS and 26.04 LTS sit in its -proposed pocket. That is an opt-in testing channel whose packages do not install automatically. Canonical tests kernel updates across more than 2,000 certified servers and devices before pushing them to the regular channel. It has given no release date. "The Ubuntu Security Team believes that security updates are the only appropriate mitigation," Canonical said.

UmbrelOS 2.0.1 carried the kernel fix for x86 devices on 1 November. It applied a traffic-blocking mitigation on Raspberry Pi, where a fixed kernel was not yet available. No one has reported confirmed in-the-wild exploitation, and the flaw is not on CISA's Known Exploited Vulnerabilities catalog.

Interim mitigations

Red Hat published an nftables rule on 30 October that drops inbound IPv4 TCP packets carrying IP options. The company says it cannot fully prevent exploitation and may break workloads that depend on IPv4 options. The filter applies only to the host where it is loaded; traffic between containers on the same host can bypass it, a member of the CIQ kernel team noted on the oss-security mailing list.