# Critical Linux Kernel Flaw Threatens Self-Hosted Amnezia VPN Servers Users running Xray protocols must manually patch servers to prevent remote exploitation of vulnerability. - **Source:** [Latest from TechRadar](https://www.techradar.com/feeds.xml) - **Published:** 2026-11-11 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/b714dcd6-21fd-4d14-bacc-f76e4dc33c31 ## Critical Kernel Vulnerability Identified A severe Linux kernel flaw, tracked as CVE-2026-98432, poses a significant threat to self-hosted VPN servers. With a high severity score of 9.8 out of 10, the bug affects how the kernel manages IPv4 TCP connections. It has persisted in Linux versions since 4.4, leaving numerous private server configurations exposed to potential attacks. ## Exploitation Mechanism and Risks The vulnerability is a race condition that tricks the operating system into mishandling memory during internet connections. Anthropic researcher Xinyang Ge reported that an unreleased Claude model successfully created an exploit. This allows attackers to take full control of a vulnerable server in approximately 53 minutes without requiring any user interaction or passwords. ## Xray Protocol Exposure Factors Servers using the Xray protocol are at the highest risk due to their reliance on Multipath TCP (MPTCP). Because Xray is developed using the Go programming language, it automatically enables MPTCP by default. This makes server administrators unknowingly vulnerable, as the feature runs in the background without explicit configuration or manual activation by users. ## Managed Services Remain Secure Amnezia VPN confirmed that its Premium, Free, and Business service tiers are currently unaffected by this security flaw. The provider has already audited and updated its own infrastructure to mitigate the risk. Consequently, users of these managed services do not need to perform any manual updates or changes to their existing VPN setups. ## Required Three-Step Patch Process Self-hosted users must update to app version 5.1.0.6 or later to access the new server package update tool. The process involves removing Xray from the Protocols tab, updating server packages via the Management tab, and rebooting the system. Finally, users must reinstall Xray to ensure the server utilizes the patched version 26.10.31. ## Operational Impact of Updates Applying the security patch requires a server reboot, which will temporarily take the service offline. Existing Xray connections will be terminated, necessitating that administrators re-share access credentials with their users. This disruption is a mandatory step to ensure the kernel is properly patched and the memory handling vulnerability is effectively neutralized for users. ## Limitations and Alternative Mitigations The update button does not guarantee a fully patched kernel on all distributions, as some Ubuntu versions still hold the fix in testing channels. If patching fails, Amnezia recommends implementing firewall rules to block IP options. Alternatively, users can remove Xray entirely and switch to the UDP-based AmneziaWG protocol to maintain server security. ## Ongoing Maintenance for Security This incident highlights the inherent risks of self-hosting infrastructure compared to managed services. Administrators must remain vigilant, as future reboots could potentially re-expose the server until official distribution patches are finalized. Regularly monitoring security advisories and maintaining updated software versions remains the primary defense against sophisticated exploits targeting core networking protocols. ## Sources covering this story - https://www.techradar.com/vpn/vpn-services/running-your-own-amnezia-vpn-server-you-need-to-patch-this-critical-linux-flaw-now — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._