Amnezia VPN has issued an urgent advisory to individuals operating their own servers through its application, warning that a severe Linux kernel vulnerability leaves their infrastructure exposed. Administrators utilizing the Xray protocol face particular danger and must rebuild their server configurations immediately to maintain operational security.
The security bug, officially tracked under the identifier CVE-2026-98432, resides deep within the underlying code that the Linux operating system utilizes to accept incoming IPv4 TCP connections. Having been present across Linux kernels since version 4.4, the vulnerability received a critical severity score of 9.8 out of 10 from the kernel security team. While Amnezia VPN maintains that its managed Premium, Free, and Business services remain completely unaffected because the provider has already updated and audited its central infrastructure, self-hosted administrators must perform manual remediation steps to protect their systems.
Key takeaways
- CVE-2026-98432 is a critical Linux kernel flaw with a severity score of 9.8 out of 10.
- Servers running the Xray protocol face the highest risk due to default MPTCP settings.
- An unreleased Claude model developed a working exploit that can take over a server in 53 minutes.
- Amnezia released app version 5.1.0.6 featuring a direct package update button to help fix the bug.
Understanding the Xray and MPTCP Threat Vector
The core security bug stems from a classic race condition, which is a software flaw that tricks the operating system into mishandling its own memory during an active internet connection. The vulnerability was originally reported by Anthropic researcher Xinyang Ge, and on October 27, Anthropic disclosed that an unreleased Claude model had successfully written a working exploit for the flaw. Requiring zero user interaction and no administrative passwords, the exploit can fully take over a vulnerable server in approximately 53 minutes.
The attack vector specifically targets servers utilizing an advanced networking feature called Multipath TCP, commonly referred to as MPTCP. This specific architectural requirement is precisely where the Xray protocol becomes uniquely vulnerable. Because Xray is constructed using the Go programming language, it automatically enables MPTCP by default. Consequently, countless server administrators could be leaving the vulnerability wide open in the background without ever realizing it.
How Self-Hosted Users Can Secure Their Servers
To combat the threat, Amnezia has outlined a strict three-step remediation process that requires app version 5.1.0.6 or later. This specific software update introduces a dedicated button allowing administrators to update system packages directly on the server, a feature built specifically in response to this bug. Users must first navigate to Settings, select Servers, and remove Xray from the Protocols tab. Following this, administrators should open the Management tab, choose to update server packages, and reboot the system to load the patched kernel.
Once the system restarts, users must return to the Protocols tab and reinstall Xray to use the patched version 26.10.31. Because the server goes offline during the reboot process, existing Xray connections will drop and require administrators to share access with their users again. Furthermore, the update button does not completely guarantee a fixed kernel on all operating systems, as certain Ubuntu versions still maintain the patch exclusively in the testing channel. For environments unable to patch the kernel immediately, Amnezia recommends establishing a temporary firewall rule to block IP options or switching entirely from Xray to the UDP-based AmneziaWG protocol.
Comments