@kazani
Linux kernel vulnerability in the golang MPTCP, allowing for remote code execution (RCE), is announced.
Bitcoin developer Peter Todd urges all LND noderunners using Linux to shut down or upgrade their kernel ASAP
"Important notice for the Bitcoin community: if you are running lnd on Linux, and it has open ports, you should shut it down until you patch your Linux kernel or otherwise mitigate CVE-2026-98432.
Not lnd's fault. But there's a Linux kernel exploit with mptcp that is relevant.
Basically, if the command ss -Mlnp returns anything, you are potentially vulnerable to this exploit.
In addition to patching, this can be used to disable mptcp:
echo 'net.mptcp.enabled=0' | sudo tee /etc/sysctl.d/99-disable-mptcp.conf && sudo sysctl -p /etc/sysctl.d/99-disable-mptcp.conf && sudo ss -Mlnp"
https://x.com/peterktodd/status/2116039505954185279