lnd v0.21.6-beta disables MPTCP listeners to block remote exploit path for Linux kernel CVE-2026-98432

Summary

Lightning Labs released lnd v0.21.6-beta to mitigate CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP stack. The flaw is not specific to MPTCP, but the demonstrated remote exploit needs an MPTCP listener, which Go 1.24+ enables by default. The release turns off MPTCP listeners in lnd by default. Lightning Labs states this "is a mitigation, not a fix: the kernel patch is the only fix."

Affected

• lnd nodes on Linux hosts whose kernels are vulnerable to CVE-2026-98432 and that run lnd builds with Go's default MPTCP listeners (releases before v0.21.6-beta). The Defiant also reports v0.20.7-beta for the older release line.
• Windows and macOS are not affected.
• Mitigated in lnd v0.21.6-beta. The full fix is a patched Linux kernel.

Impact

Lightning Labs describes a demonstrated remote exploit of the kernel use-after-free through an MPTCP listener, and Go 1.24+ binaries such as lnd open these listeners by default. Other services on the same host are not covered by the lnd change. The release notes do not state whether this has been exploited in the wild.

Recommended actions

• Upgrade to lnd v0.21.6-beta.
• If you cannot upgrade yet, start your existing binary with GODEBUG=multipathtcp=0. Do not set GODEBUG=multipathtcp=1 until your kernel is patched.
• Disable MPTCP on the host (sudo sysctl -w net.mptcp.enabled=0), because other services on the machine are not covered by this release.
• Install a patched kernel as soon as your distribution ships one. See the release notes for Docker and firewall guidance.

Source & attribution

This 0xCERT advisory summarises the lnd v0.21.6-beta release notes by Lightning Labs: https://github.com/lightningnetwork/lnd/releases/tag/v0.21.6-beta (Go discussion: golang/go#82717). Details may change; refer to the original source for the authoritative record.