Anza Tells Solana Validators to Guard Against 9.8-Rated Linux Bug

Anza, a lead Solana software developer, told mainnet validators on Sunday to act now on a Linux kernel flaw rated 9.8 out of 10. Ubuntu, the system Anza builds for, has no fixed kernel out yet.

The warning was labeled "Action Required," The Defiant reported. No attack on a Solana validator has been reported.

The bug under the node

The flaw, CVE-2026-98432, sits in how Linux sets up IPv4 TCP connections, per the kernel's own advisory. Two processor cores can race, and one can free a piece of memory the other is still reading. Researchers at Anthropic built an exploit that ran commands as root on a server with a Multipath TCP listener, BleepingComputer reported. Red Hat rated it lower, at 5.9, because the race is hard to win.

Root means full control of the machine. A validator keeps its identity key on that machine, so a takeover could expose it, and a kernel failure could knock it offline. Anza's guidance says the separate withdraw authority, which controls staked funds, should never sit on the server.

Three stopgaps

Tim Garcia, validator relations lead at the Solana Foundation, gave Ubuntu operators three steps, TokenPost reported: block incoming TCP packets carrying IPv4 options, turn off Multipath TCP and turn off TCP request socket migration. They are not a fix. The upstream kernel fix exists, but Ubuntu's tracker listed versions 22.04 through 26.10 as vulnerable with work in progress. BleepingComputer said there were no confirmed reports of exploitation in the wild.

In our opinion: Kernel upkeep is dull work, and dull work is where validators get caught. Solana's speed rests on a few thousand Linux boxes, and their weakest kernel matters as much as any code on chain. Watch for Ubuntu's patched kernel and how fast operators reboot into it.