Bitcoin Lightning’s security update shuts one door. A critical Linux flaw remains

The LND software update disables Multipath TCP listeners by default, closing a demonstrated route for attackers. This change applies to versions 0.20.7-beta and 0.21.6-beta released on October 30.

However, the update does not fully secure the system. A critical vulnerability in the Linux kernel, with a CVSS 3.1 score of 9.8, remains unpatched. This flaw involves freed memory being used during IPv4 TCP connection handling and can allow an attacker to run code on the host.

The issue arises because Go 1.24 and later enabled MPTCP listeners by default on Linux. LND 0.21.x consequently exposed these listeners on its peer, gRPC, and REST ports, which are used for connections to other nodes and application interfaces.

The Go Security Team’s advisory explains that disabling MPTCP in one program is fragile. A single remaining exposed listener on the same unpatched machine can preserve the demonstrated attack route, even after LND’s default listeners have been changed.

Patch availability varies by package

Operators must check the specific kernel package for their system, as availability varies by distribution and variant. The Ubuntu tracker shows that the standard linux package for Ubuntu 24.04 LTS is still labeled vulnerable, with work in progress in version 6.8.0-149.149.

Ubuntu 22.04 LTS carries the same status for version 5.15.0-203.213. The tracker also lists the standard Ubuntu 26.10 linux package as fixed in version 7.3.0-10.10, but cloud, hardware-enablement, and other kernel variants have separate entries.

Canonical’s November 2 advisory states that kernel fixes for this CVE are available in the -proposed repository for users who run their own kernel acceptance tests. Qualification testing is ongoing, and some releases, including 24.04, have advanced to -updates.

Operators therefore need to check the available update for their exact kernel package rather than infer availability from the Ubuntu release name alone. A fixed status for one package cannot settle the status of another.

Protection still requires work on the host

LND maintainers recommend upgrading the application, disabling MPTCP on the host, and installing a patched kernel as soon as the distribution makes one available. The setting can be applied per network namespace, so Docker deployments need separate attention to the container’s network configuration.

Operators who cannot upgrade LND immediately can start their existing binary with GODEBUG=multipathtcp=0 to disable Go’s default MPTCP listeners. Maintainers warn against re-enabling that default before patching the kernel.

Canonical advises checking the kernel actually running with uname -r. After installing its kernel security update, a reboot is required. An upgraded LND binary and an installed kernel package are different milestones; completing the operating-system repair requires running the patched kernel.