Solana validators told to filter traffic over unpatched Linux flaw

On Nov. 2, Anza sent an “Action Required” alert to Solana mainnet-beta validators regarding a critical vulnerability in the Linux kernel that has yet to be patched by Ubuntu.

The Solana developer quoted a thread from Tim Garcia, the Solana Foundation’s validator relations lead, telling Ubuntu operators to filter traffic until a fix arrives.

Garcia wants Multipath TCP and socket migration switched off

In Garcia’s thread, he lists three changes to make until an Ubuntu package is available. Operators should employ nftables to drop inbound TCP packets with IPv4 options.

He advised them to disable Multipath TCP with net.mptcp.enabled=0. net.ipv4.tcp_migrate_req=0 disables migration of TCP request sockets.

Filtering shrinks exposure but does not fully stop exploitation, Red Hat warned.

The notice is for validators running Ubuntu. Anza’s requirements stipulate the client builds and runs on Ubuntu 24.04 and needs a public IPv4 address.

The kernel defect, CVE-2026-98432, has been patched upstream, Garcia said. There is no update published yet for Ubuntu users.

The CVE was first published on October 15 and last updated on October 30 by Canonical’s tracker. The main kernel package on 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS is marked as “Vulnerable work in progress”.

Older 20.04 and 18.04 builds are just listed as vulnerable. The bug has a CVSS score of 9.8 and an Ubuntu priority of High.

CVE-2026-98432 leaves the kernel reading freed memory

CVE-2026-98432: Use-after-free in kernel IPv4 code. Even after the memory is freed, the kernel can still read memory that was part of a network connection.

Canonical’s description links it to the TCP handshake for incoming connections. The child socket is freed while a retransmitted SYN for the same request socket is being processed by a second CPU, resulting in ip_options_build() reading freed memory.

There is a similar bug when the TCP request socket migration is on, which is why Garcia turns it off in his list. IPv6 avoids the first problem, as its handshake code duplicates the options.

On Nov. 1, Red Hat published advisories with kernel fixes for RHEL 8, 9 and 10. Debian has fixed packages for bookworm and trixie.

Crypto infrastructure has been struck by Linux flaws before this year. In May 2026, Cryptopolitan reported about two kernel bugs, Copy Fail and Dirty Frag, that put exchanges, validators and custody systems on alert.

A compromised Linux server can expose signing credentials and admin access on the box.

Solana operators were urged to apply a critical validator patch, v3.0.14, in January. This time the bug is in the kernel the client depends on, below the client software.