LND ships MPTCP mitigation for critical Linux kernel flaw. CryptoDeepApp - November 4, 2026 - CryptoDeepApp Editorial Lightning Labs moved quickly to narrow exposure from a Linux kernel networking flaw that had become relevant for Bitcoin Lightning infrastructure. The project's latest LND releases disable Multipath TCP listeners by default, which shuts off the specific path used in a public proof-of-concept exploit against Go-based Linux services. Why this bug mattered to Lightning operators. The underlying issue, CVE-2026-98432, is a use-after-free in the Linux kernel's IPv4 TCP handshake code. Anthropic said its Frontier Red Team produced a proof-of-concept exploit that could let a remote attacker send packets to a Linux server with an MPTCP listener and execute commands as root without credentials or user interaction. That detail mattered because Go 1.24 enables MPTCP on listeners by default, so servers built in Go can inherit the risk unless developers turn it off explicitly. For Lightning users, the connection is straightforward: LND runs in Go, and on Linux it can expose network-facing ports that line up with the attack path. The concern is not limited to Lightning software itself; the kernel bug sits below the application layer, which means any other service on the same host can still be exposed until the host is patched or MPTCP is disabled system-wide. What LND changed in the emergency releases. Lightning Labs published v0.21.6-beta and the v0.20.7-beta backport on October 30, 2026. Both releases disable MPTCP listeners by default. In the release notes, the project described that change as a mitigation rather than a fix and said the kernel patch is the only complete remedy. * Upgrade LND to the new release if you run a Lightning node on Linux. * Disable MPTCP on the host if other services on the machine could still listen with it enabled. * Install a patched kernel as soon as your distribution ships one. * If you cannot upgrade immediately, Go applications can be started with GODEBUG=multipathtcp=0 to turn off the default listener behavior. The release notes also make clear that Windows and macOS are not affected by this Linux-specific issue. What to watch next. Official vendor guidance has emphasized that the practical fix is to update the kernel and reboot. AWS, for example, said a kernel update and reboot are the only complete remediation, and that the issue requires a publicly reachable IPv4 TCP port to be exploitable. That means internet-facing Linux servers deserve the most urgent attention, while systems with no exposed TCP services are less exposed. Ubuntu said fixes for CVE-2026-98432 were being tested in the -proposed pocket for Ubuntu 22.04 LTS and newer, which is a reminder that distribution timelines can differ even when the upstream kernel fix is already available. For operators, the key point is simple: the LND update reduces immediate risk for Lightning services, but the host still needs a kernel-level patch before the flaw is fully resolved. Sources. About CryptoDeepApp CryptoDeepApp is a cryptocurrency platform for instant crypto swaps, Solana token analysis, portfolio tracking and market analytics.

71% of flagged LND nodes remain on affected lines through Oct. 13. The affected lines accounted for 14.9% of live public LND nodes when Lightning Labs disclosed six denial-of-service flaws on Aug. 11. Published Nov 2, 2026, 4:21 AM EST Mentioned assets At an Oct. 13 cutoff, 71% of a group of public Bitcoin (BTC) Lightning nodes flagged on affected LND release lines in August remained on those lines, showing slow migration after a security warning. Discover more Bitcoin price prediction Bitcoin investment guide Trade Crypto Now Lightning Labs disclosed six denial-of-service vulnerabilities on Aug. 11. At that point, the affected lines represented 14.9% of live public LND nodes and 6.4% of their channel capacity in an analysis that excluded one managed fleet. The 71% result applies only to nodes flagged then, not to the Lightning Network as a whole. By Oct. 13, 10% of the flagged group had moved to newer release lines and 20% were no longer live. Those figures and the 71% remaining on affected lines are rounded. The fixes had shipped in LND v0.19.0-beta on May 22, 2025, 446 days before disclosure. LND is software for operating nodes on the Lightning Network, which carries Bitcoin payments through channels outside Bitcoin's main transaction layer. Bitcoin Data Labs researcher Saurabh Kumar examined 814 daily snapshots of the public network from May 2023 through Oct. 13. Node announcements reveal software features but no version string, so the analysis estimates release lines rather than identifying exact patch versions. It also cannot observe unannounced nodes, including many mobile wallets. "Exposure is not exploitability," Kumar wrote. Advertising an affected release line does not establish whether an individual node met the conditions required for an attack. The findings describe visible software patterns, not confirmed vulnerabilities in every flagged installation. The three largest observed LND upgrade waves followed Umbrel app releases. Each involved 262 to 385 nodes, at least 87% of which advertised a newer line within 48 hours of the relevant Umbrel release. Those releases came 19 to 41 days after the corresponding LND releases. The timing does not establish which platform any individual node used. Across nine LND security disclosures that could be tested, the weekly share of live nodes on affected release lines moving to newer lines showed no statistically detectable increase. Around the Aug. 11 disclosure, that share measured 1.4% both before and after. A smaller response cannot be ruled out. Discover more Crypto market analysis Blockchain news subscription Cryptocurrency trading course Lightning Labs has urged node operators to update to v0.19.0-beta or later. Simon Yoon. Simon Yoon reports on blockchain technology for TokenPost. Send corrections or tips to [email protected].

Bitcoin as mortgage collateral, treasury shakeout, and the AI payment race. Better and Coinbase funded the first Fannie Mae-backed Bitcoin-collateralized mortgage in June 2026. The corporate treasury boom is bifurcating. Lightning Labs is racing Coinbase's Ethereum-based x402 to become the default payment rail for autonomous AI agents. Three adoption signals in 2026 point to the same conclusion: Bitcoin is becoming structural infrastructure, not just a speculative asset. Key takeaways * Better and Coinbase funded the first Fannie Mae-backed Bitcoin-collateralized mortgage in June 2026, letting holders borrow against their sats for a down payment without selling them, with a nationwide rollout planned for Summer 2026. * The Bitcoin corporate treasury boom is bifurcating: leveraged, weak-handed companies are exiting or restructuring while high-conviction accumulators keep buying. * Lightning Labs' L402 protocol is competing directly with Coinbase's Ethereum-based x402 to become the default payment rail for autonomous AI agents, a race with decades of transaction flow at stake. Better Home & Finance (NASDAQ: BETR) and Coinbase (NASDAQ: COIN) announced June 4, 2026 that they had funded the first Fannie Mae-backed mortgage in the U.S. using Bitcoin as collateral, with a nationwide rollout set for Summer 2026. Simultaneously, the corporate Bitcoin treasury wave is separating conviction from financial engineering, and Lightning Labs is racing to make Bitcoin the native money of the agentic economy. Bitcoin as conforming-loan collateral. The structure works via two loans. Loan one is a standard conforming mortgage eligible under Fannie Mae guidelines. Loan two is an overcollateralized loan secured by Bitcoin (or USDC) held in a Coinbase Prime custody account, the proceeds of which fund the cash down payment. The first borrowers were a married couple in Ann Arbor, Michigan buying their first home. The product was announced March 26, 2026, with Better CEO Vishal Garg citing "52 million Americans who own digital assets" as the target market. Coinbase's Max Branzburg called it "a major first step to unlocking homeownership for the younger generations that have struggled with barriers to saving for a traditional down payment." The regulatory groundwork was laid in June 2025, when the Federal Housing Finance Agency directed Fannie Mae and Freddie Mac to develop proposals recognizing crypto as a qualifying mortgage asset without requiring conversion to dollars. The practical implication is straightforward. The average U.S. home price exceeded $405,000 in Q4 2024, putting a standard 20% down payment above $80,000. For the Bitcoin holder sitting on a stack accumulated over years, the historical answer was: sell the sats, fund the down payment, lose the upside. This structure removes that forced liquidation. Hold the coins, pledge them, get the house. Coinbase has stated that price volatility alone does not trigger margin calls as long as borrowers make scheduled payments, though that is company policy, not a regulatory protection. JPMorgan already accepts Bitcoin as loan collateral for institutional clients. Better and Coinbase just brought that same logic to the conforming mortgage market. The treasury shakeout is doing its job. Roughly 198 public companies hold approximately 1.268 million BTC combined, per Bitcoin Treasuries tracker data as of early July 2026. The combined market cap of Bitcoin treasury stocks has dropped roughly $62 billion from peak. About 40% of treasuries were trading at a discount to NAV in Q1-Q2 2026. The exits are confirming what was predictable. K Wave Media sold its remaining 88 BTC on July 1, 2026, to repay approximately $6 million in debt. Genius Group sold its final 84 BTC in Q1 2026 to repay $8.5 million in debt. Bitdeer cut holdings to 31 BTC by March 2026, pivoting to AI cloud. Bitcoin Standard Treasury Company (BSTR Holdings) terminated its business combination with Cantor Equity Partners on August 20, 2026, with the company citing "significant pricing pressure amid challenging market conditions." Galaxy Digital warned in December 2025 that at least five digital asset treasury companies faced asset sales or closure in 2026. That call is playing out. The accumulators, meanwhile, are not flinching. American Bitcoin grew its treasury to 8,002 BTC through Q2 2026. Metaplanet added 2,823 BTC on July 2, reaching 43,000 BTC. Strive reached 19,900 BTC with a purchase on July 13. See also Satsuma's 668 BTC liquidation for a clean case study in what happens when the structure was wrong from the start. The AI payment rail nobody is covering. Lightning Labs released its Lightning Agent Tools on February 12, 2026, and launched a dedicated site for the L402 protocol on July 29, 2026, positioning Lightning as the native payment rail for autonomous AI agents. The pitch is architectural, not theoretical. When an AI agent hits a resource requiring payment, the server returns an HTTP 402 ("Payment Required") response. The agent pays the Lightning invoice and receives cryptographic proof of payment with no account, no API key, and no identity verification required. As Lightning Labs' Michael Levin described it, the toolkit "allows AI systems to run a Lightning node, pay for services, and host paid endpoints without needing identity verification, API keys, or traditional registration." The competing protocol is Coinbase's x402, which uses the same HTTP status code but runs on Ethereum-based rails. It has moved to the Linux Foundation with backing from Google, Stripe, and Visa. The question is which money the machine economy runs on: Bitcoin over Lightning, or dollar-denominated stablecoins over Ethereum. AI agents can't open bank accounts, which is precisely why the payment rail they adopt by default matters enormously. What to watch. The Better/Coinbase nationwide rollout is the near-term signal. If conforming lenders adopt the structure at scale and Fannie Mae begins guaranteeing these mortgages without incident, Bitcoin's status as GSE-eligible collateral becomes entrenched. If Fannie Mae formally rejects the structure, or if L402 stalls while x402 becomes the AI industry standard, the thesis breaks. The treasury shakeout will continue until the remaining holders are those who bought with conviction and without borrowed capital. That process tends to resolve quietly. Sources. * Better/Coinbase product announcement, March 26, 2026 * Better/Coinbase first funded loan announcement, June 4, 2026 * BSTR Holdings SEC Form 8-K, August 20, 2026