Solana developer Anza and the Solana Foundation issued an urgent advisory to mainnet‑beta validators on Nov. 1, urging immediate action against CVE‑2026‑98432, a critical Linux vulnerability rated 9.8 out of 10.
Researchers have demonstrated an exploit that can grant attackers root access to vulnerable Linux servers without credentials or user interaction. The flaw originates from a memory‑handling error in IPv4 TCP connection processing that can be triggered through a race condition.
Current patch status
The underlying issue has been fixed in the upstream Linux kernel, but Ubuntu – the operating system most commonly used by Solana validators – has not yet released a patch. Ubuntu’s security tracker listed the kernel package for Ubuntu 24.04 as “Vulnerable work in progress” as of Nov. 2, with version 6.8.0‑149.149 identified as the pending fix.
Recommended mitigations
Tim Garcia, validator relations lead at the Solana Foundation, advised operators to implement temporary protections until an Ubuntu update becomes available. The recommended steps include:
- Blocking incoming TCP packets that contain IPv4 options.
- Disabling Multipath TCP (MPTCP).
- Turning off TCP request‑socket migration.
These measures aim to reduce exposure, though Red Hat cautioned that they may not eliminate risk entirely and could affect certain workloads.
Broader ecosystem response
Other Linux distributions have already released patched kernels. Amazon Web Services confirmed that updated packages are available for Amazon Linux 2 and Amazon Linux 2023, and instructed operators to apply the updates and reboot.
While the demonstrated exploit required a specific MPTCP configuration, no evidence has been presented that any Solana validator has been compromised. The actual risk to validators depends on each server’s kernel version and network settings.
Next steps for validators
Validators running Ubuntu 24.04 should monitor Ubuntu’s security announcements, apply the forthcoming kernel update when released, and verify the running kernel version after rebooting. Continued vigilance is advised until the official patch is deployed.
