Developer Matt Corallo identified a critical Linux kernel vulnerability, tracked as CVE-2026-98432, which carries a CVSS severity score of 9.8. The flaw affects the IPv4 TCP handshake mechanism and can be leveraged for remote root access on systems utilizing Multipath TCP listeners.
Lightning Labs released emergency updates, specifically lnd v0.21.6-beta and v0.20.7-beta, to mitigate the risk. These versions disable MPTCP listeners by default in the LND software, which is written in Go and susceptible due to default settings in Go 1.24 and later versions.
Security researcher Marcus Hutchins reported widespread internet scanning for vulnerable systems, identifying approximately 2.1 million servers reachable via MPTCP on port 443. While Lightning Labs provided a mitigation, the underlying kernel issue persists until a system-level patch is applied.
Operating system vendors have begun addressing the flaw. Red Hat released patches for RHEL 8, 9, and 10 on November 1, while Canonical has provided fixed kernels for Ubuntu 22.04, 24.04, and 26.04 in the proposed channel. UmbrelOS 2.0.1 also integrated a kernel fix for x86 devices.
