Anza, the developer behind Solana’s main validator client, has told Solana validators on mainnet-beta to act immediately on a critical Linux kernel flaw that Ubuntu has not yet patched. The bug, CVE-2026-98432, can be triggered remotely with crafted network packets, and researchers have shown it can lead to code execution on some hosts.
Ubuntu is the operating system Anza builds and tests its validator software on, so operators who follow that setup are running a kernel with no fixed package available yet.
What Anza and the Solana Foundation asked validators to do
Early on Monday Anza flagged the issue to mainnet-beta validators as “URGENT” and “Action Required,” pointing operators to a thread from Tim Garcia, validator relations lead at the Solana Foundation. “CVE-2026-98432 is patched in the linux kernel but not yet patched on ubuntu,” Garcia wrote, before listing three stopgap measures for Ubuntu machines:
- Drop incoming TCP packets that carry IPv4 options, using an nftables rule.
- Turn off Multipath TCP by setting net.mptcp.enabled to 0.
- Turn off TCP request socket migration by setting net.ipv4.tcp_migrate_req to 0.
None of these replace a kernel update. They close the paths the bug relies on until Canonical ships a fixed kernel, at which point operators still need to install it and reboot.
What the vulnerability does
CVE-2026-98432 is a use-after-free bug in the code that handles the start of an IPv4 TCP connection. Under the right timing, the kernel can free memory holding a connection’s IP options while another part of the kernel is still reading it. It was published on Oct. 15 and carries a CVSS 3.1 score of 9.8, rated critical, according to Ubuntu’s security tracker.
Amazon Web Services gives the clearest summary of the risk. Its security bulletin says kernels from version 4.4 onward are affected and that “a remote, unauthenticated third-party could send crafted IPv4 TCP packets that carry IP options to an affected listener.” The result could be a kernel crash, leaked kernel memory or memory corruption. AWS added: “Researchers have demonstrated unauthenticated remote code execution against hosts with a Multipath TCP (MPTCP) listener.” It also said it is not aware of the bug being exploited in the wild. Amazon Linux kernels with the fix are already available.
Ubuntu is further behind. Its tracker, last updated on Oct. 30, lists the main Linux kernel package for Ubuntu 22.04, 24.04, 26.04 and 26.10 as vulnerable with a fix in progress, and older releases including 20.04 as vulnerable. Ubuntu rates the issue as high priority.
Why a kernel bug matters to a blockchain
Smart contract exploits get most of the attention, but a validator is a Linux server first. Anza’s own requirements say a validator needs a public IPv4 address, which means it accepts traffic from the open internet by design. A remotely reachable kernel flaw is close to the worst kind of bug for that setup.
The two likely outcomes carry different costs. A crash knocks a validator offline, so it misses votes and any leader slots it was due to produce blocks in. Code execution is more serious, because the validator’s identity keypair has to sit on the machine for the node to sign anything. An attacker with control of the host could take that key and the SOL kept on the identity account to pay for votes.
There is a limit to the damage if operators follow Anza’s long-standing advice. Its security best practices say the authorized withdrawer key, which controls a validator’s vote account and the rewards held there, “should never be stored on your validator at any time.” Operators who kept that key on a hardware wallet or offline would not lose control of their vote account even if the server itself were taken over.
The warning follows another recent case where the risk sat below the blockchain rather than in it. Last week, domain redirects at registrar Name.com sent visitors of 12 DeFi sites to a wallet drainer. In both cases the weak point was ordinary internet infrastructure, not smart contract code.
What to watch
The open item is a fixed Ubuntu kernel. Until it ships, validators depend on the firewall and sysctl changes, and a rule that is not saved can be lost on reboot. Neither Anza nor the Solana Foundation has reported any attack on a Solana validator using this bug, and no disruption to the network has been reported.
The flaw is not specific to Solana. Any Linux server with a vulnerable kernel that accepts IPv4 TCP connections is in scope, which includes nodes on many other networks, RPC providers and exchange infrastructure.
FAQ
Has the Linux flaw been used against Solana validators?
No attack has been reported. Anza’s warning is preventive, and AWS says it is not aware of exploitation in the wild.
Do the mitigations fix CVE-2026-98432?
No. Blocking TCP packets with IPv4 options and disabling Multipath TCP and request socket migration reduce exposure until Ubuntu releases a patched kernel, which operators then need to install.
Can an attacker steal a validator’s staking rewards through this bug?
Only if the authorized withdrawer key is stored on the compromised server. Anza’s guidance says that key should never be kept on the validator machine.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
