TCP hole punching for Bitcoin nodes behind home NATs?

Recent discoveries of critical vulnerabilities, such as CVE-2026-117350 and CVS-2026-117349 in the Bitcoin protocol, alongside CVE-2026-98432 affecting the Linux TCP stack, have raised concerns about network security for individual users. These bugs highlight significant risks associated with handling incoming network connections on systems running affected software.

Given the nature of these vulnerabilities—which can potentially lead to denial-of-service conditions or compromise system stability—it is advisable for home users to avoid listening for unsolicited incoming connections. Disabling this feature acts as a precautionary measure, minimizing exposure to potential attacks that exploit these weaknesses. By restricting external access, users reduce the surface area available for attackers leveraging such vulnerabilities, thus enhancing the overall security posture of their systems.

The prudent course of action is to maintain a more defensive configuration, particularly while patches or mitigations are being developed and deployed. Limiting inbound connectivity not only protects against newly discovered threats but also serves as a general best practice for reducing risk in environments where comprehensive monitoring and rapid response capabilities may be limited.