lnd v0.20.7 and v0.21.6 released with a Go mitigation (disabling MPTCP) for CVE-2026-98432
According to lnd, releases v0.20.7 and v0.21.6 contain a Go-specific mitigation — disabling the MPTCP flag — for CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP implementation. The source stresses that this is a kernel-level vulnerability: only a kernel patch fully fixes it, since any network service may be affected; known PoCs use MPTCP, but other vectors are not ruled out. The developers recommend that all users update.
Operators of lnd nodes on Linux: update to v0.20.7 or v0.21.6 as recommended by the source. Existing binaries can be protected by launching them with the environment variable GODEBUG=multipathtcp=0. Regardless of the lnd update, apply the Linux kernel patch — according to the source, only this fully resolves the vulnerability, and it concerns any network service on the host. The releases and Go explanation are linked in the post.