Linux Kernel CVE: Why Solana Validators Were Warned

By Owen Thurm Published November 6, 2026 5 min read

Quick answer. In November 2026, Anza and the Solana Foundation warned validators about CVE-2026-98432, a 9.8-rated Linux kernel flaw in IPv4 TCP. Until Ubuntu ships a fix, they advised filtering IPv4-option packets and disabling Multipath TCP and request socket migration.

Watch: Linux Kernel CVE: Why Solana Validators Were Warned 1:45

Video transcript

Solana validators were warned about a critical Linux kernel flaw. The bug is not in Solana's code, but in the operating system beneath it.

CVE-2026-98432 is a use-after-free in the kernel's IPv4 TCP handshake. Its record scores it 9.8, reachable over the network with no login.

Validators face the internet. Anza runs on Ubuntu 24.04, and its requirements call for a public IPv4 address and ports 8000 to 8030 open to any source.

Ubuntu was the gap. Debian and Amazon Linux had fixed kernels, but as of November 5, Ubuntu's tracker still listed 24.04 as vulnerable.

Until a fix ships, the Solana Foundation's Tim Garcia advised three stopgaps: filter packets with IPv4 options, disable Multipath TCP, and disable request socket migration.

Each stopgap is partial. Red Hat says filtering cannot fully prevent exploitation, and AWS says only a kernel update and reboot fully fixes it.

AWS reports no evidence of exploitation so far. But Anthropic's research showed a working exploit reaching root.

Operators should check the running kernel on every host, reapply settings after reboots, keep SSH and RPC closed, and confirm the fixed kernel after patching.

Guardian's Managed Security ingests disclosures in real time and matches them to your systems. A Guardian engineer then confirms exposure and helps you patch.

Read the full article for the timeline and operator checks, or talk to Guardian.

A Solana validator runs more than validator software. Underneath it sits a Linux kernel, and in October 2026 a critical flaw in that kernel went public.

On November 2 (UTC), Anza posted an "Action Required" alert to mainnet-beta validators on X. It quoted Tim Garcia, the Solana Foundation's validator relations lead, as CryptoSlate and Cryptopolitan describe him.

Garcia's post opened: "Validators! CVE-2026-98432 is patched in the linux kernel but not yet patched on ubuntu."

The flaw is in the operating system. ForkLog noted it is "not directly related to Solana's code."

What the Flaw Is

CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP code. The kernel's CVE team published the record on October 15, 2026.

The bug sits in the TCP handshake. When a server accepts a connection, IP options from the client's SYN pass to the new socket without being copied.

A retransmitted SYN can race with that socket's teardown. The kernel then reads memory it has already freed, per the CVE record.

A similar race exists when TCP request socket migration is on (net.ipv4.tcp_migrate_req=1). The fix frees the options only after an RCU grace period.

Field	Detail	Source
Affected	Kernels 4.4 and later	CVE record, AWS
Score	CVSS 3.1 9.8, Critical	CVE record, Ubuntu, Red Hat
Access needed	Network only; no login or user action	CVE record, Red Hat
Fixed stable kernels	5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10	CVE record
IPv6	Not affected by the main issue	Ubuntu

Red Hat rates it Critical. It says exploitation requires precise timing but no privileges or user interaction.

How the Attack Works

On October 27, 2026, Anthropic published research on an exploit for the bug. Its AI model, Claude, wrote the exploit "after initial prompting."

It targets Linux servers with a Multipath TCP (MPTCP) listener and needs no credentials or user interaction. It runs in two stages:

Leak: win the race to read kernel memory and learn a kernel pointer. Anthropic's proof of concept took 48 minutes.
Execute: use the same bug to overwrite a callback pointer and run a shell command as root. That took another five minutes.

A lost race only fails the handshake without crashing the system, Anthropic says, so an attacker can retry.

MPTCP is not the whole story

The Go security team noted that Go 1.24 and later enable MPTCP by default on Linux listen sockets. It also said "the underlying bug is not specific to MPTCP."

Red Hat says disabling MPTCP "is not a complete mitigation." AWS says crafted IPv4 packets with IP options can cause a kernel crash, memory disclosure or memory corruption.

Why Validators Were Warned

A validator is an internet-facing Linux host that accepts TCP from anyone. Anza's validator requirements show why:

The Anza team builds and runs on Ubuntu 24.04.
A public IPv4 address is required, and running behind NAT is discouraged.
TCP and UDP on ports 8000 to 8030 must be open to any source.

Ubuntu was the gap. As of its November 5 update, Ubuntu's tracker listed the main 24.04 kernel as vulnerable, with a fix in progress.

Other platforms had moved. Debian's tracker shows fixed kernels for bookworm and trixie, and AWS released fixed Amazon Linux kernels.

The interim guidance

Garcia's steps for Ubuntu validators, as CryptoSlate and Cryptopolitan report them:

Drop inbound TCP packets that carry IPv4 options, using nftables.
Disable Multipath TCP: net.mptcp.enabled=0.
Disable TCP request socket migration: net.ipv4.tcp_migrate_req=0.

Each stopgap has limits. Red Hat says its own packet filter rule "cannot fully prevent" exploitation, must be reapplied after a reboot, and may disrupt workloads.

The real fix is a new kernel. AWS says "A kernel update and reboot is the only complete remediation for this issue."

For a validator, that reboot means planned downtime. Schedule it, then confirm the new kernel is the one running.

Timeline and Exposure

Date (2026)	Event	Source
Oct 15	CVE record published	CVE Program
Oct 27	Anthropic publishes its exploit research	Anthropic
Oct 29	Go security team advisory on MPTCP	oss-security
Oct 30	Red Hat and AWS bulletins	Red Hat, AWS
Nov 2 (UTC)	Anza alerts mainnet-beta validators	Anza on X
Nov 5	Ubuntu's tracker still lists 24.04 as vulnerable	Ubuntu

Here is the exposure, with each point attributed.

Exploitation: AWS says it has no evidence of exploitation so far.
Validators: CryptoSlate reported no evidence that Solana validators had been compromised.
Scope: no source we read counts how many validators ran an affected kernel.
Loss: none of the sources we read reports one.

What It Shows

The OS is part of the validator. Reviewing the client alone leaves the kernel beneath it unexamined.
Fixed upstream is not fixed for you. Debian had kernels out while Ubuntu, the platform Anza runs, was still waiting.
Defaults widen exposure. Go 1.24 and later turn MPTCP on for Linux listeners, so check what your services enable.
A working exploit exists. Anthropic's proof of concept reached root in about 53 minutes.
Stopgaps are partial. Red Hat, AWS and the Go team all warned that theirs fall short.

Checks for validator operators

Run uname -r on every host and compare it with your distribution's tracker.
Apply the packet filter and sysctl settings until a fixed kernel ships, and reapply after reboots.
Look for MPTCP listeners, but do not treat their absence as safety.
Keep SSH and RPC ports closed to the internet, as Anza's requirements advise.
Plan the reboot, and confirm the fixed kernel is running afterward.

For an earlier flaw below the application layer, read our explainer on OpenSSH regreSSHion. For the wider picture, see Is Solana secure?

How Managed Security Tracks Advisories

Guardian's Managed Security page lists this advisory among its recent examples: CVSS 9.8, Linux kernel, November 2026, "Solana validators warned."

The service ingests vulnerability disclosures in real time and matches them against your system.

Where one reaches you, a Guardian engineer confirms the exposure and works with you to patch it.

Managed Security also includes Shield, which runs reconnaissance and penetration testing around the clock against the hosts, ports and services you expose.

Read the Managed Security announcement for the full service, or another recent advisory, PHP2Shell.

Frequently Asked Questions

What is CVE-2026-98432?

A use-after-free in the Linux kernel's IPv4 TCP handshake code, affecting kernels 4.4 and later. Its CVE record scores it 9.8: a remote attacker with no login can corrupt kernel memory, and researchers showed code execution as root.

Is Solana's software vulnerable?

No. The flaw is in the Linux kernel, not in Solana's code. Validators were warned because they run on internet-facing Linux hosts, and Anza builds and runs on Ubuntu 24.04, which had no fixed kernel at the time.

How can validators mitigate it before Ubuntu ships a fix?

Garcia's guidance: drop inbound TCP packets with IPv4 options, set net.mptcp.enabled=0 and set net.ipv4.tcp_migrate_req=0. Red Hat says filtering cannot fully prevent exploitation, so install the fixed kernel and reboot once it ships.

Has CVE-2026-98432 been exploited?

AWS says it has no evidence of exploitation, and CryptoSlate reported no evidence that Solana validators were compromised. Anthropic's research exploit reached root in about 53 minutes against a server with an MPTCP listener.

Sources

Know when the next advisory reaches your nodes

Guardian Managed Security matches disclosures like CVE-2026-98432 to what you run, and an engineer works the patch through with your team.

Talk to Guardian Explore Managed Security