en
Back to the list

Anza Urges Solana Validators to Act on Critical Linux Flaw

source-logo  thedefiant.io 1 h
image

Solana software developer Anza urged mainnet-beta validators to act immediately on a critical Linux kernel vulnerability in a Nov. 1 warning labeled “Action Required,” while Ubuntu's security tracker still showed fixes in progress.

The flaw, CVE-2026-98432, carries a CVSS 3.1 severity score of 9.8, or critical, from the Linux kernel's CVE authority. It is a use-after-free bug: during IPv4 TCP connection setup, the kernel can free network-option memory while another operation is still using it.

Anthropic said its research model built a proof-of-concept exploit that lets a remote attacker run commands as root on Linux servers with a Multipath TCP listener, without credentials or user interaction. Root access gives an attacker control of the host, rather than just an application.

Know when your
coins move

Alerts, real-time prices, and market news — all in one app
qr-code Point your phone camera to install
4.8 based on 40K reviews in the App Store and Google Play
The exposure reaches the operating system beneath the validator software. Anza's requirements say it builds and runs on Ubuntu 24.04 and requires a public IPv4 address. A successful host takeover could expose the validator identity key stored on the machine; a kernel crash could interrupt block production. Anza's operator guidance says the separate withdrawer key should never be stored on the server.

Three Interim Steps for Ubuntu Operators

Anza's warning amplified a thread from Tim Garcia, the Solana Foundation's validator relations lead. His guidance calls for Ubuntu operators to:

  • Use nftables to block incoming TCP packets containing IPv4 options.
  • Disable Multipath TCP with sudo sysctl -w net.mptcp.enabled=0.
  • Disable TCP request socket migration with sudo sysctl -w net.ipv4.tcp_migrate_req=0.

Disabling MPTCP stops new sockets from being created but does not close existing listeners. AlmaLinux's mitigation guidance says operators should list those listeners with sudo ss -lnMp and restart the services that own them.

These measures are not a kernel fix. Red Hat warns that filtering reduces exposure but cannot fully prevent exploitation, and says operators should test the rule against their network requirements. The Go Security Team also cautions that the underlying bug is not specific to MPTCP, so systems without MPTCP listeners may be vulnerable to similar attacks.

Ubuntu Fix Remains in Progress

As of Sunday evening ET, Ubuntu's tracker, last updated Oct. 30, listed the main Linux kernel package on Ubuntu 22.04, 24.04, 26.04 and 26.10 as “Vulnerable work in progress.” No fixed Ubuntu kernel was listed as available. The upstream Linux fix has already been backported to maintained stable kernel branches, according to Anthropic.

Red Hat has published kernel fixes for RHEL 8, RHEL 9 and RHEL 10 in advisories dated Nov. 1. Debian's tracker lists fixed security packages for bookworm and trixie, and Amazon Linux lists fixes for its affected Linux 2 and Linux 2023 kernels.

Red Hat's update advisories specify that the system must reboot for the kernel update to take effect.

thedefiant.io