lnd 0.21.6 turns off MPTCP listeners to block a Linux kernel exploit path
Victoria Shinder1 min readThe lnd project released v0.21.6-beta and v0.20.7-beta late on 30 October as security releases for operators on Linux. The trigger is CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP stack. The flaw is not specific to Multipath TCP, but the release notes say the demonstrated remote exploit needs an MPTCP listener, and Go 1.24 and later enable MPTCP listeners by default.
The new releases disable MPTCP listeners in lnd by default, which closes the demonstrated path through lnd. The project is explicit that this is a mitigation, not a fix: only the kernel patch fixes the bug. It asks Linux operators to upgrade, to disable MPTCP on the whole host with sysctl net.mptcp.enabled=0 because other services on the machine are not covered, and to install a patched kernel as soon as their distribution ships one.
Operators who cannot upgrade yet can start their existing binary with GODEBUG=multipathtcp=0, which switches off Go's default MPTCP listeners; the notes warn against setting multipathtcp=1 until the kernel is patched. Windows and macOS are not affected, and the release carries no database migrations.
What it means
A Lightning node is a hot wallet with an open port, so a remotely reachable kernel bug is a funds problem, not just an uptime one. The unusual part is the route: the exposure came through a language runtime default rather than anything lnd chose. That is worth checking beyond lnd, because any Go service on the same host that opened a listener inherits the same default.