Anza warns Solana validators about critical Linux CVE-2026-98432
Anza warned Solana validators on November 1, 2026 about CVE-2026-98432, a critical Linux kernel flaw rated 9.8. Ubuntu's patch was still pending.
Anza warned Solana mainnet validators on November 1, 2026 to act on CVE-2026-98432, a critical Linux kernel flaw. The CVE carries a CVSS 3.1 score of 9.8. The underlying bug is fixed upstream in the Linux kernel, but Ubuntu packages used by many validators were still marked vulnerable as of November 5.
Key facts
- CVE: CVE-2026-98432 (CVSS 3.1 score 9.8, Critical) (Ubuntu)
- Alert: Anza urgent notice to mainnet-beta validators on November 1, 2026 (CryptoSlate)
- Issue: use-after-free in IPv4 TCP connection handling that can lead to remote code execution
- Ubuntu 24.04 status (Nov 5): Vulnerable, work in progress toward 6.8.0-149.149
- Ubuntu 22.04 status (Nov 5): Vulnerable, work in progress toward 5.15.0-203.213
- Compromise of Solana validators: none reported
What operators were told to do
Solana Foundation validator relations lead Tim Garcia said the flaw is patched in the Linux kernel but not yet on Ubuntu. Interim steps reported for Ubuntu operators include:
- Drop incoming TCP packets that carry IPv4 options
- Disable Multipath TCP (MPTCP)
- Disable TCP request-socket migration
Ubuntu's own guidance says security updates are the proper fix. As of its November 2 blog, corrected kernels for 22.04 and newer sat in the -proposed pocket while qualification tests ran. Red Hat and AWS have both said packet filters reduce exposure but do not fully prevent exploitation.
What the research showed
Anthropic reported on October 27 that an unreleased research model built an exploit for this CVE. In its demo, the model reached root command execution on a Linux server with an MPTCP listener in about 53 minutes. The demonstrated path used MPTCP. Ubuntu notes that the vulnerability itself is not limited to MPTCP.
What to watch
Operators should watch the Ubuntu CVE page for when the fix leaves -proposed and lands in updates, then install the kernel and reboot. There is no public evidence that a Solana validator was compromised through this flaw.
