Solana developer Anza has warned validators to act against a critical Linux vulnerability rated 9.8 out of 10. Ubuntu has not yet patched the flaw, so operators must rely on temporary protections. No evidence shows any Solana validator has been compromised.
Anza, a Solana-focused software developer, issued an urgent warning on Nov. 1 to mainnet-beta validators, calling for immediate action against CVE-2026-98432. The vulnerability could allow hackers to remotely take control of affected Linux servers.
Tim Garcia, validator relations lead at the Solana Foundation, said the underlying flaw is already fixed in the Linux kernel but not in Ubuntu, an operating system commonly used by Solana validators. According to Garcia: "Validators! CVE-2026-98432 is patched in the linux kernel but not yet patched on ubuntu."
Temporary protections until Ubuntu ships a fix
Garcia advised affected operators to block incoming TCP packets containing IPv4 options, disable Multipath TCP (MPTCP), and turn off TCP request-socket migration until a security update arrives.
However, the Ubuntu security tracker still listed the main Linux kernel package for Ubuntu 24.04 as "Vulnerable work in progress" as of Nov. 2, with version 6.8.0-149.149 as the planned fix. Red Hat warned that blocking malicious IPv4 traffic cannot completely eliminate exposure and could interfere with some workloads.
Other distributions have moved faster. Amazon Web Services confirmed that corrected kernel packages are available for Amazon Linux 2 and Amazon Linux 2023, and told operators to update and reboot their servers.
Researchers demonstrated a remote takeover
The flaw stems from a memory-handling error during IPv4 TCP connection processing that can let attackers exploit a race condition without authentication or user interaction. In research published Oct. 27, Anthropic disclosed that an unreleased Claude research model developed an exploit capable of executing commands with root privileges on Linux servers running an MPTCP listener. Anthropic said its demonstration took approximately 53 minutes to achieve remote command execution.
Such access could give attackers control over a server, potentially compromising a validator's operations and sensitive credentials stored on the machine. Still, the demonstrated exploit involved a specific MPTCP configuration, and the research does not establish that every validator is vulnerable.
Anza's validator requirements specify Ubuntu 24.04 and public IPv4 connectivity, although actual exposure depends on each server's kernel version and network configuration. How many Solana validators run affected configurations remains unknown.
Source: CryptoSlate
Trading involves risk.
Risk Disclaimer
