Solana validators warned over critical Linux vulnerability

Solana developer Anza warned mainnet-beta validators on Nov. 1 about CVE-2026-98432, a Linux kernel vulnerability with a severity rating of 9.8 out of 10. Researchers demonstrated that the flaw could allow remote command execution with root privileges without authentication or user interaction.

The underlying flaw has been fixed in the Linux kernel but remained unpatched in Ubuntu, which is commonly used by Solana validators. Tim Garcia, validator relations lead at the Solana Foundation, wrote: “Validators! CVE-2026-98432 is patched in the linux kernel but not yet patched on ubuntu.”

Anza advised operators to block incoming TCP packets containing IPv4 options, disable Multipath TCP, and turn off TCP request-socket migration while they wait for an Ubuntu security update. These settings can reduce exposure, although they may affect some workloads.

The vulnerability stems from an error in the kernel’s handling of memory during IPv4 TCP connection processing. The flaw involves a race condition, which occurs when two processes access the same data at nearly the same time.

Anthropic reported on Oct. 27 that an unreleased Claude research model had developed an exploit for Linux servers running an MPTCP listener. The demonstration first exposed kernel memory information and then used that information to execute commands with root privileges. Anthropic reported that the process took about 53 minutes.

Root access could allow an attacker to control a validator server and obtain credentials stored on it. The demonstrated exploit depended on a specific MPTCP configuration. There is no evidence that Solana validators have been compromised, and the research does not establish that every validator is exposed.

Ubuntu’s security tracker listed its main Linux kernel package for Ubuntu 24.04 as “Vulnerable work in progress” on Nov. 2. It identified version 6.8.0-149.149 as the planned fix. Operators will need to install the package after its release, reboot their servers and confirm that the new kernel is active.

Red Hat warned that blocking malicious IPv4 traffic may not fully remove the risk and could disrupt some workloads. Amazon Web Services reported that corrected kernel packages were available for Amazon Linux 2 and Amazon Linux 2023 and instructed users to update and reboot affected servers.

Anza’s validator requirements specify Ubuntu 24.04 and public IPv4 connectivity. Actual exposure depends on each server’s kernel version and network configuration. The number of Solana validators running an affected configuration is not known.