LND Ships Maintenance Releases After CVE-2026-98432 MPTCP Fix

Lightning Labs published lnd v0.21.8-beta and lnd v0.20.8-beta on November 11, 2026, according to the project's GitHub release feed for lnd, the dominant implementation of the Lightning Network node software used across the Bitcoin ecosystem. Both are maintenance releases with no database migrations, per the release notes published on each tag.

From an emergency MPTCP patch to routine cleanup

The two November releases follow an unscheduled security release issued less than two weeks earlier. On October 30, 2026, Lightning Labs shipped lnd v0.21.6-beta to address CVE-2026-98432, a use-after-free vulnerability in the Linux kernel's IPv4 TCP stack, per the release notes for that version.

The v0.21.6-beta notes state the flaw is not specific to Multipath TCP (MPTCP), but that a demonstrated remote exploit requires an active MPTCP listener — a feature Go 1.24 and later enable by default. Lightning Labs' release notes describe the October patch as disabling MPTCP listeners in lnd by default, which the project states closes the demonstrated exploit path through lnd specifically. The same notes are explicit that this is a mitigation, not a fix: the underlying kernel vulnerability can only be resolved with a kernel patch, something outside lnd's control. The October release notes also recommended that Linux operators running lnd upgrade to the patched version as a first step.

Lightning Labs has not published a changelog entry in either the v0.21.8-beta or v0.20.8-beta release notes crediting new code changes to the MPTCP issue specifically; both are described in their respective release pages only as carrying no database migrations, which typically signals routine dependency and bug-fix work rather than a new security disclosure.

What the gap between releases tells operators

The sequence — an emergency MPTCP mitigation on October 30, followed by two parallel-branch maintenance releases on November 11 — reflects how lnd maintains multiple active version branches (0.20.x and 0.21.x) concurrently, a pattern visible across the project's GitHub release history. Node operators running either branch have separate upgrade paths to follow depending on which major version they track.

Lightning Labs' own guidance, as stated in the v0.21.6-beta notes, remains the operative instruction for the kernel-level exposure: operators on Linux should upgrade lnd to close the demonstrated exploit path, while recognizing that a full fix depends on a kernel-level patch outside the project's control. No further CVE disclosures appear in the v0.21.8-beta or v0.20.8-beta release notes as of this writing. Operators running Lightning infrastructure, a core piece of Bitcoin's payment-layer stack, can verify release authenticity using the PGP signature process documented in each release's own notes before deploying either update.