Critical Linux Kernel Vulnerability Sparks Urgent Mitigations from Lightning Labs

On October 30, Bitcoin Core and Lightning developer Matt Corallo raised alarms about a critical Linux kernel vulnerability, CVE-2026-98432, which he described as potentially the most severe flaw in Linux history. The vulnerability, with a CVSS severity score of 9.8, affects the kernel's IPv4 TCP handshake code and poses significant risks for systems utilizing Multipath TCP (MPTCP) listeners.

Corallo criticized Ubuntu for its delayed response to the issue, which was later demonstrated by Anthropic's Frontier Red Team, showing that the flaw could be exploited remotely to gain root access to affected systems. Peter Todd, another prominent figure in the Bitcoin community, advised operators running Lightning Network Daemons (LND) on Linux to shut down their nodes until a patch was implemented.

In response to the vulnerability, Lightning Labs released emergency updates: lnd v0.21.6-beta and backport v0.20.7-beta, which disable MPTCP listeners by default, mitigating the immediate threat. However, the underlying kernel issue remains unaddressed until a patched kernel is installed. Security researcher Marcus Hutchins reported widespread scanning activity targeting exposed systems, revealing approximately 2.1 million servers vulnerable to the exploit.

While Canonical has made patched kernels available for some Ubuntu versions, they have not yet reached the regular updates channel. Other distributions, including Red Hat and Debian, have already released fixes. The practical exposure is highest on internet-facing servers, while home systems behind NAT and firewalls are less at risk.