Critical Linux Kernel Flaw Threatens Self-Hosted Amnezia VPN Servers
Users running Xray protocols must manually patch servers to prevent remote exploitation of vulnerability.
1Critical Kernel Vulnerability Identified
A severe Linux kernel flaw, tracked as CVE-2026-98432, poses a significant threat to self-hosted VPN servers. With a high severity score of 9.8 out of 10, the bug affects how the kernel manages IPv4 TCP connections. It has persisted in Linux versions since 4.4, leaving numerous private server configurations exposed to potential attacks.
2Exploitation Mechanism and Risks
The vulnerability is a race condition that tricks the operating system into mishandling memory during internet connections. Anthropic researcher Xinyang Ge reported that an unreleased Claude model successfully created an exploit. This allows attackers to take full control of a vulnerable server in approximately 53 minutes without requiring any user interaction or passwords.
3Xray Protocol Exposure Factors
Servers using the Xray protocol are at the highest risk due to their reliance on Multipath TCP (MPTCP). Because Xray is developed using the Go programming language, it automatically enables MPTCP by default. This makes server administrators unknowingly vulnerable, as the feature runs in the background without explicit configuration or manual activation by users.
4Managed Services Remain Secure
Amnezia VPN confirmed that its Premium, Free, and Business service tiers are currently unaffected by this security flaw. The provider has already audited and updated its own infrastructure to mitigate the risk. Consequently, users of these managed services do not need to perform any manual updates or changes to their existing VPN setups.
5Required Three-Step Patch Process
Self-hosted users must update to app version 5.1.0.6 or later to access the new server package update tool. The process involves removing Xray from the Protocols tab, updating server packages via the Management tab, and rebooting the system. Finally, users must reinstall Xray to ensure the server utilizes the patched version 26.10.31.
6Operational Impact of Updates
Applying the security patch requires a server reboot, which will temporarily take the service offline. Existing Xray connections will be terminated, necessitating that administrators re-share access credentials with their users. This disruption is a mandatory step to ensure the kernel is properly patched and the memory handling vulnerability is effectively neutralized for users.
7Limitations and Alternative Mitigations
The update button does not guarantee a fully patched kernel on all distributions, as some Ubuntu versions still hold the fix in testing channels. If patching fails, Amnezia recommends implementing firewall rules to block IP options. Alternatively, users can remove Xray entirely and switch to the UDP-based AmneziaWG protocol to maintain server security.
8Ongoing Maintenance for Security
This incident highlights the inherent risks of self-hosting infrastructure compared to managed services. Administrators must remain vigilant, as future reboots could potentially re-expose the server until official distribution patches are finalized. Regularly monitoring security advisories and maintaining updated software versions remains the primary defense against sophisticated exploits targeting core networking protocols.