LND update blocks one Lightning exploit route, but critical Linux kernel flaw remains

What the LND release fixes (and what it doesn't)

LND's operator notes say Go 1.24 and later turned on MPTCP listeners by default on Linux, which LND 0.21.x then exposed on its peer, gRPC and REST ports. The new releases switch those listeners off.

That shuts one door. Not all of them.

The kernel flaw itself stays in place, and the update doesn't cover other services on the same machine. If another exposed MPTCP service runs on an unpatched host, the demonstrated route can stay open even after LND's default change. The bug involves freed memory being used during IPv4 TCP connection handling in Linux, and it can let an attacker run code on an affected host. Ubuntu gives it a critical CVSS 3.1 score of 9.8.

The Go team says the bug is broader

The Go Security Team's advisory said the demonstrated exploit needs an exposed MPTCP listener, but the kernel bug goes further. Similar attacks against systems without MPTCP listeners may be possible, according to the advisory (it doesn't establish a demonstrated non-MPTCP exploit). Go also warned that disabling MPTCP one program at a time is fragile: a single leftover exposed listener keeps the system vulnerable, and explicit socket settings can override Go's default.

It's a demonstrated Linux exploit, not evidence that attackers used the flaw against LND nodes or stole bitcoin. The Core Lightning channel and remote-command fixes reported November 6 concern separate application flaws.

Kernel patch status varies by package

The Ubuntu tracker, checked November 9 and last updated November 7, still labeled the standard linux package for Ubuntu 24.04 LTS vulnerable, with work in progress in 6.8.0-149.149. The 22.04 LTS entry carried the same status for 5.15.0-203.213, while the standard 26.10 package was listed as fixed in 7.3.0-10.10. Cloud, hardware-enablement and other kernel variants have separate entries.

Canonical said in a November 2 advisory that fixes were available in the -proposed repository for users who run their own kernel acceptance tests, while qualification testing continued. Ubuntu's newsletter for November 1–7 said some releases, including 24.04, had advanced to -updates, without identifying every kernel variant.

Operators need to check the update for their exact kernel package. LND maintainers recommend upgrading the application, disabling MPTCP on the host and installing a patched kernel as soon as the distribution makes one available. LND's update changes the app; repairing the shared Linux kernel requires a separate host update.