CVSS 9.8: The Linux Flaw That Could Let Hackers Root Your Bitcoin Node Right Now
A remote attacker can gain full root access to your Linux machine without a single password, and the Bitcoin developer community is scrambling to respond.
Matt Corallo, one of the most respected engineers in Bitcoin Core and Lightning development, flagged CVE-2026-98432 on October 30. The vulnerability lives inside the Linux kernel's IPv4 TCP handshake code and carries a CVSS score of 9.8 out of 10, meaning security researchers classify it as near-worst-case severity. This is not a theoretical risk sitting in a research paper. Anthropic's Frontier Red Team already demonstrated a working remote root exploit against systems running a Multipath TCP listener. That means the proof of concept exists. That means it is a matter of time before less ethical actors weaponize it.
Why Bitcoin and Lightning Operators Should Be Losing Sleep
The vast majority of Bitcoin full nodes and Lightning Network routing nodes run on Linux servers. Many of those servers use TCP configurations that could expose the vulnerable code path. A successful exploit does not just mean someone reads your data. Root access means an attacker controls the machine entirely, including any hot wallets, channel funds, or private keys stored on the device.
For Lightning node operators specifically, the exposure is acute. Lightning channels require private keys to be accessible at runtime. A compromised server is a drained channel.
Lightning Labs Already Moved
The good news is that Lightning Labs shipped a mitigation inside LND before most of the industry even registered the threat. That is exactly the kind of rapid response that prevents a critical vulnerability from becoming a catastrophic industry event. If you are running LND, update immediately and confirm you are on the patched version.
If you are running any other Lightning implementation or a Bitcoin full node on Linux, the action item is the same: patch your Linux kernel, disable Multipath TCP if you are not actively using it, and audit your server exposure. Check whether your node is accessible to the open internet and reduce that surface area wherever possible.
What Crypto Holders Should Watch Right Now
This story will accelerate a conversation the Lightning community has needed to have about operational security standards for routing nodes. Watch for other Lightning implementations, including Core Lightning and Eclair, to ship their own mitigations in the coming days.
If you custody any meaningful Bitcoin through a Lightning node you operate yourself, treat this as a five-alarm drill. The exploit is real, the proof of concept exists, and the window between disclosure and active exploitation in the wild is shrinking every hour.
Patch first. Ask questions later.