LND TURNED OFF THE LINUX MPTCP LISTENERS A 9.8-RATED KERNEL EXPLOIT NEEDS — BTCD, THE GO BITCOIN NODE, STILL OPENS ONE ON PORT 8333 — NO BTCD ISSUE FILED

On October 30, 2026, Lightning Labs shipped lnd 0.21.6 and 0.20.7 with a one-line change to the build file: godebug multipathtcp=0. It stops lnd from opening Multipath TCP listeners on Linux. Go’s security team had written on October 29 that in a published exploit for CVE-2026-98432, a Linux kernel bug rated 9.8 out of 10 in its NVD record, “a server using Multipath TCP (MPTCP) listeners is shown to be vulnerable to Remote Code Execution (RCE).” Go programs open those listeners by default since Go 1.24. lnd’s notes say it “therefore exposed” them on its peer, gRPC and REST ports.

btcd is a full bitcoin node written in Go, and lnd can run on top of it. I read btcd’s code at v0.27.0, its latest release, dated October 21. Its build file says go 1.26.10 and has no multipathtcp line. Its peer listener calls Go’s plain net.Listen, by default on all interfaces at port 8333. Go’s own documentation says that from Go 1.24 the setting “defaults to multipathtcp="2", thus enabled by default on listeners.” As of November 2, 2026, btcd’s master branch is the same, and no btcd issue or pull request mentions MPTCP.

The limits. I read the code; I didn’t run btcd on a test machine. The exposure needs a Linux kernel with MPTCP switched on. lnd’s notes say that if the setting doesn’t exist, the kernel “has no MPTCP support and is not exposed through this path.” Windows and macOS aren’t affected. And the Go team warns that “the underlying bug is not specific to MPTCP,” so turning MPTCP off closes the shown exploit, not the bug. A btcd operator can do what lnd tells its own users: start the node with GODEBUG=multipathtcp=0, turn MPTCP off on the host, and install a patched kernel.

Why it matters: a node is how you check bitcoin’s rules for yourself, and an lnd node keeps keys that can spend. A machine a stranger can run code on checks nothing for you and keeps nothing safe. This one is easy to check without trusting anyone. On Linux, sudo ss -Mlnp lists every MPTCP listener on the box. If btcd shows up, it’s exposed. At the time of this writing, bitcoin was $77,890.