Anza issued an "Action Required" alert on Nov. 2 urging Solana mainnet-beta validators to mitigate a critical vulnerability in the Linux kernel that Ubuntu has yet to patch.

The Solana software developer quoted a thread from Tim Garcia, the Solana Foundation's validator relations lead, directing operators running Ubuntu to filter traffic until a fix arrives.

Validators are the machines that process Solana transactions and maintain network consensus, so an unpatched flaw in their operating system sits on core infrastructure rather than on ancillary tooling.

Garcia wants Multipath TCP and socket migration switched off

In Garcia's thread, he lists three changes to make until an Ubuntu package becomes available. Operators should employ nftables to drop inbound TCP packets carrying IPv4 options.

He also advised disabling Multipath TCP with net.mptcp.enabled=0, while net.ipv4.tcp_migrate_req=0 turns off migration of TCP request sockets.

Red Hat warned that filtering shrinks exposure but does not fully stop exploitation.

The notice applies to validators running Ubuntu. Anza's requirements stipulate that the client builds and runs on Ubuntu 24.04 and needs a public IPv4 address — the address family whose inbound TCP handshake path contains the flaw.

According to Garcia, the kernel defect, CVE-2026-98432, has been patched upstream, but no update has been published yet for Ubuntu users. Because the defect sits in the kernel, no validator-client release can close it on Ubuntu hosts; the fix has to come through the distribution.

CVE-2026-98432 leaves the kernel reading freed memory

Canonical's tracker, which first published the CVE on October 15 and last updated it on October 30, marks the main kernel package on 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS as "Vulnerable work in progress." Older 20.04 and 18.04 builds are simply listed as vulnerable. The bug carries a CVSS score of 9.8 — within the scale's critical range — and an Ubuntu priority of High.

CVE-2026-98432 is a use-after-free flaw in the kernel's IPv4 code: even after memory is freed, the kernel can still read memory that was part of a network connection. Canonical's description links it to the TCP handshake for incoming connections — the child socket is freed while a retransmitted SYN for the same request socket is being processed by a second CPU, resulting in ip_options_build() reading freed memory.

A similar bug occurs when TCP request socket migration is enabled, which is why Garcia turns it off in his list. IPv6 avoids the first problem, as its handshake code duplicates the options.

On Nov. 1, Red Hat published advisories with kernel fixes for RHEL 8, 9 and 10, and Debian has fixed packages for bookworm and trixie. Ubuntu-based operators, meanwhile, remain on Garcia's mitigations until Canonical's kernel package arrives and moves the CVE out of "Vulnerable work in progress."

Linux flaws have struck crypto infrastructure before

Crypto infrastructure has been hit by Linux flaws earlier this year. In May 2026, Cryptopolitan reported on two kernel bugs, Copy Fail and Dirty Frag, that put exchanges, validators and custody systems on alert. A compromised Linux server can expose signing credentials and admin access on the machine.

In January, Solana operators were urged to apply a critical validator patch, v3.0.14. This time, the bug sits in the kernel the client depends on — below the client software itself, which is why Anza's alert routes operators to operating-system mitigations rather than a software upgrade.