Bitcoin Core and Lightning developer Matt Corallo flagged the severe Linux kernel vulnerability CVE-2026-98432 on October 30, which affects the IPv4 TCP handshake and carries a CVSS severity score of 9.8. Anthropic demonstrated that it could be turned into a remote root exploit against systems exposing a Multipath TCP listener, a configuration enabled by default since Go 1.24 and present in some recent LND versions. Lightning Labs released lnd v0.21.6-beta and lnd v0.20.7-beta in an emergency response, disabling Multipath TCP listeners by default and closing the demonstrated exploit path without fixing the underlying kernel flaw. Roughly 2.1 million servers reachable over Multipath TCP on port 443 were found, although no confirmed exploitation has been reported. Canonical has placed patched kernels in an opt-in channel for Ubuntu 22.04, 24.04, and 26.04, while Red Hat, Debian, Amazon Linux, and other distributions have already released fixes.
Source: Read the original article
