Heraldo de Madrid - Amnezia VPN Urges Self-Hosted Users to Patch Critical Linux Kernel Flaw CVE-2026-98432

Amnezia VPN has issued an urgent warning for self-hosted server administrators, advising immediate action to address a critical Linux kernel vulnerability tracked as CVE-2026-98432. The flaw specifically impacts servers utilizing the Xray protocol, which automatically enables Multipath TCP (MPTCP), leaving them exposed to potential remote takeover without user interaction.

The vulnerability resides in the code Linux uses to accept new IPv4 TCP connections and has been present in the kernel since version 4.4. The Linux kernel security team has assigned the flaw a severity score of 9.8 out of 10, classifying it as critical. It is a race condition bug that tricks the operating system into mishandling its own memory during internet connections.

The issue was reported by Anthropic researcher Xinyang Ge. On October 27, Anthropic announced that an unreleased Claude model had written a working exploit for the vulnerability. The exploit requires zero user interaction and no passwords to execute. According to the report, it could fully take over a vulnerable server in approximately 53 minutes.

The attack targets servers using MPTCP, an advanced networking feature. Xray, which serves as the engine behind censorship-resistant protocols like VLESS, is built with the Go programming language. This architecture causes Xray to enable MPTCP by default. Amnezia rates this configuration as high risk because server administrators may inadvertently leave the vulnerability open in the background without realizing it.

Amnezia VPN clarified that its managed Premium, Free, and Business services remain unaffected because the provider has already updated and audited its own infrastructure. The warning is directed solely at self-hosted users who must manage their own security updates.

To address the issue, Amnezia has released a fix requiring version 5.1.0.6 or later of its application. This update includes a new button to update packages on the server directly, a feature added in response to this specific flaw. The provider also noted a previous Xray-core refresh in September and an earlier mandatory update for Premium and Free users.

The remediation process involves three distinct steps. First, administrators must navigate to Settings, then Servers, select their specific server, and remove Xray from the Protocols tab. Second, they must open the Management tab, choose Update server packages, and reboot the system when prompted. This reboot is necessary to load the patched kernel.

Third, users must return to the Protocols tab and reinstall Xray. The newly installed version will be 26.10.31, which utilizes the patched kernel. Administrators should note that their server will go offline during the reboot, and existing Xray connections will stop working. Access will need to be shared with users again after the process is complete.

Amnezia cautioned that the update button does not guarantee a fixed kernel on all systems. On certain Ubuntu versions, the patch is only available in the "-proposed" testing channel. Until a future app release resolves this dependency, any subsequent reboot may leave the server vulnerable again until the Xray reinstall is repeated.

For users unable to patch the kernel immediately, Amnezia suggests implementing a firewall rule that blocks IP options as a temporary mitigation. Alternatively, administrators can remove Xray and switch to the UDP-based AmneziaWG protocol to maintain security while the kernel issue is resolved.

I.Ponce--HdM