Lightning Labs Mitigates Linux TCP Flaw in LND; Kernel Patching Still Required
Vulnerability Disclosure · 3 sources · Updated 7h ago · First seen Nov 4, 2026
Lightning Labs released LND versions v0.20.7-beta and v0.21.6-beta to mitigate a critical Linux vulnerability by disabling Multipath TCP (MPTCP) by default. The flaw, tracked as CVE-2026-98432, is described as a pre-authentication, network-reachable use-after-free in the Linux kernel’s IPv4 TCP handshake code, present since Linux 4.4. Anthropic reportedly demonstrated an exploit against an MPTCP listener that bypassed KASLR and executed commands as root, but that remote-code-execution claim has not been independently verified. Red Hat raised its severity score from 5.9 to 9.8 after initially deferring remediation; SUSE, Oracle, and Amazon assigned 8.1.
The LND update does not fix the underlying kernel vulnerability, and disabling MPTCP alone is insufficient protection. Operators should apply their distribution’s kernel fix and boot into the patched kernel; patches are available for numerous distributions, although some fixes remain outstanding. Where patches are unavailable, filtering inbound IPv4 TCP packets containing IP options removes the documented trigger. As of November 5, the security analysis reported no confirmed exploitation in the wild and no listing in CISA’s Known Exploited Vulnerabilities catalog.
