Bitcoin Lightning’s security update shuts one door. A critical Linux flaw remains
LND releases v0.20.7-beta and v0.21.6-beta disable MPTCP listeners by default, closing a demonstrated route to Linux CVE-2026-98432 but not fixing the underlying critical kernel vulnerability. Other MPTCP services on the same unpatched host may remain exposed, and broader exploitability without MPTCP listeners is possible but unproven. Ubuntu package fixes vary by kernel variant and release; operators should verify their exact package and running kernel, install the available patched kernel, and reboot. LND maintainers also recommend disabling MPTCP at the host level, checking container network namespaces, and using a Go setting to disable listeners if they cannot upgrade LND. There is no evidence the flaw has been exploited against LND nodes or caused Bitcoin losses.
