-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0319
============================================================

Advisory-ID:  0xCERT-2026-0319
Severity:     High
Published:    2026-10-30T23:21:00.000Z
Updated:      2026-11-06T16:44:03.661Z
Chains:       Bitcoin
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0319

Title: lnd v0.21.6-beta disables MPTCP listeners to block remote exploit path for Linux kernel CVE-2026-98432

Summary
- -------
Linux kernel use-after-free CVE-2026-98432 has a demonstrated remote exploit via MPTCP listeners, which Go 1.24+ binaries such as lnd open by default. lnd v0.21.6-beta disables them as a mitigation only. Upgrade, set net.mptcp.enabled=0 on the host, and install a patched kernel.

Details
- -------
Summary
Lightning Labs released lnd v0.21.6-beta to mitigate CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP stack. The flaw is not specific to MPTCP, but the demonstrated remote exploit needs an MPTCP listener, which Go 1.24+ enables by default. The release turns off MPTCP listeners in lnd by default. Lightning Labs states this "is a mitigation, not a fix: the kernel patch is the only fix."

Affected
- - lnd nodes on Linux hosts whose kernels are vulnerable to CVE-2026-98432 and that run lnd builds with Go's default MPTCP listeners (releases before v0.21.6-beta). The Defiant also reports v0.20.7-beta for the older release line.
- - Windows and macOS are not affected.
- - Mitigated in lnd v0.21.6-beta. The full fix is a patched Linux kernel.

Impact
Lightning Labs describes a demonstrated remote exploit of the kernel use-after-free through an MPTCP listener, and Go 1.24+ binaries such as lnd open these listeners by default. Other services on the same host are not covered by the lnd change. The release notes do not state whether this has been exploited in the wild.

Recommended actions
- - Upgrade to lnd v0.21.6-beta.
- - If you cannot upgrade yet, start your existing binary with GODEBUG=multipathtcp=0. Do not set GODEBUG=multipathtcp=1 until your kernel is patched.
- - Disable MPTCP on the host (sudo sysctl -w net.mptcp.enabled=0), because other services on the machine are not covered by this release.
- - Install a patched kernel as soon as your distribution ships one. See the release notes for Docker and firewall guidance.

Source & attribution
This 0xCERT advisory summarises the lnd v0.21.6-beta release notes by Lightning Labs: https://github.com/lightningnetwork/lnd/releases/tag/v0.21.6-beta (Go discussion: golang/go#82717). Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://github.com/lightningnetwork/lnd/releases/tag/v0.21.6-beta
- - CVE-2026-98432
- - https://github.com/golang/go/issues/82717
- - https://thedefiant.io/news/security/lightning-labs-releases-lnd-mitigation-for-critical-linux-flaw

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrwuCIJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmeA/HEZyiSpEUkdCQRKJD1aDu0DcyQtmnOTtE2n
hX4gzRYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAA4/gD+N4ZtIarKZ4zPhCH7
w1y7WLqoTfdRoZTz+R8cwNaUqrUA/1SsIh0dI4JO0c2SD9qP1kxwjDaPU5H2
yrmR+8SExLEH
=CF/3
-----END PGP SIGNATURE-----