lnd Ships Emergency Patch Disabling MPTCP Over Kernel Flaw

The lnd project published v0.21.6-beta on October 30, 2026, followed the same day by a backport to the older release line in v0.20.7-beta, both disabling Multipath TCP (MPTCP) listeners by default. The change mitigates CVE-2026-98432, a use-after-free vulnerability in the Linux kernel's IPv4 TCP stack, according to the release notes published on GitHub by the lightningnetwork/lnd maintainers.

What the lnd release notes say about CVE-2026-98432

Per the v0.21.6-beta and v0.20.7-beta release notes, CVE-2026-98432 is not specific to MPTCP, but the demonstrated remote exploit path requires an MPTCP listener — a feature that Go 1.24 and later enable by default. Because lnd is written in Go, any node built with a recent Go toolchain was listening on MPTCP sockets without operators necessarily knowing it.

The release notes state plainly that disabling MPTCP listeners "closes the demonstrated exploit path through lnd," but add a caveat: "It is a mitigation, not a fix: the kernel patch is the only fix." In other words, the lnd change removes the specific attack surface the maintainers were aware of, but the underlying kernel bug remains present on affected Linux systems until operators apply a kernel-level patch separately.

The release notes advise Linux operators running lnd to upgrade to the patched release. Three days earlier, the project had already shipped v0.21.5-beta on October 27, 2026, a release whose own notes describe routine verification steps and note there were no database migrations in that version — distinct from the MPTCP mitigation that followed in the subsequent releases.

Why a kernel bug matters for Lightning node operators

lnd is one of the most widely run implementations of the Lightning Network, the payments layer built on top of Bitcoin that enables fast, low-fee transactions off the base chain. Node operators run lnd as a long-lived server process, typically on Linux, which makes any remotely triggerable kernel vulnerability affecting that operating system directly relevant to node uptime and fund safety, since compromised nodes can expose channel state and routing infrastructure.

The release notes do not state that any lnd node has been compromised through this vector, nor do they name specific affected channels or operators. What they do establish is the mechanism: a Go-language default (MPTCP listeners) intersecting with a kernel-level memory-safety bug created a reachable exploit path that the maintainers chose to close at the application layer while the kernel-level fix is pending separately from distribution maintainers.

For anyone running a Lightning node, including those managing funds through a self-custody wallet setup, the operational step described in the release notes is straightforward: upgrade lnd to v0.21.6-beta or v0.20.7-beta depending on which release branch is in use, and track kernel updates separately, since the lnd patch addresses the application-level exposure and not the underlying kernel defect.