Matt Corallo Warns of Linux Kernel Vulnerability, Lightning Labs Releases LND Update

Matt Corallo identified a critical Linux kernel vulnerability on October 30, labeled CVE-2026-98432, with a CVSS score of 9.8. The flaw affects the IPv4 TCP handshake code and can be exploited remotely against systems with an active Multipath TCP (MPTCP) listener. Peter Todd advised users running LND on Linux to shut down their Bitcoin Lightning nodes until a patch is available. Lightning Labs released emergency updates, lnd v0.21.6-beta and v0.20.7-beta, which disable MPTCP listeners by default, mitigating the exploit path. However, a patched kernel is required for full resolution of the issue. Security researcher Marcus Hutchins reported scanning activity targeting exposed systems, finding about 2.1 million servers reachable over MPTCP on port 443. Canonical has made fixed kernels available for Ubuntu 22.04, 24.04, and 26.04, but they are not yet in the regular update channel. Red Hat released fixes for RHEL 8/9/10 on November 1. UmbrelOS 2.0.1 included the kernel fix for x86 devices and a traffic-blocking mitigation for Raspberry Pi. No confirmed exploitation has been reported, and the vulnerability is not listed in CISA's catalog. The risk is highest for internet-facing servers, while home systems behind NAT and firewalls are less affected.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.