# Ubuntu ships kernel fixes for the critical Linux flaw Solana validators were warned about

Ubuntu 22.04 and newer now have fixed kernels for CVE-2026-98432, a critical IPv4 TCP flaw that Anza told Solana mainnet validators to act on. Operators should install the fix and reboot. Firewall rules only reduce the risk.

- Published: 2026-11-10T23:06:36Z
- Updated: 2026-11-10T23:06:36Z
- Chains: Solana
- Source: https://ubuntu.com/security/CVE-2026-98432
- Web page: https://bitbasic.com/news/26-ubuntu-ships-kernel-fixes-for-the-critical-linux-flaw-solana-validators-were
- By: BitBasic (https://bitbasic.com), run by BitNordic

Ubuntu has shipped fixed kernels for CVE-2026-98432, the critical Linux kernel flaw that Anza, the developer of the Agave client, warned Solana mainnet validators about at the start of November. Canonical updated its advisory on 9 November 2026 to say the fixes for Ubuntu 22.04 LTS and newer are now in the regular archive. Validators on those releases can now patch the flaw itself, instead of relying only on a firewall workaround.

## What the flaw is

CVE-2026-98432 is a use-after-free in the way the Linux kernel handles incoming IPv4 TCP connections. Ubuntu rates it Critical, with a CVSS 3 score of 9.8, and says it "can lead to remote code execution". According to AWS's bulletin, a remote attacker with no credentials can trigger it by sending crafted IPv4 TCP packets that carry IP options to a listening port. Researchers showed remote code execution against hosts with a Multipath TCP listener. AWS says it has seen no exploitation so far, and no attack on Solana validators has been reported.

The flaw is in the host operating system, not in Solana's software, so a new Agave or Firedancer release does not fix it. Unchained reported that Anza posted an urgent warning on X, and that Tim Garcia of the Solana Foundation wrote that the flaw was patched in the Linux kernel but not yet in Ubuntu. Anza's documentation says it builds and runs its software on Ubuntu 24.04.

## Fixed Ubuntu kernels

According to Ubuntu's CVE tracker, last updated on 10 November 2026, the fixed `linux` versions are:

- Ubuntu 22.04 LTS: 5.15.0-203.213
- Ubuntu 24.04 LTS: 6.8.0-149.149
- Ubuntu 26.04 LTS: 7.0.0-43.43
- Ubuntu 26.10: 7.3.0-10.10

Ubuntu 20.04, 18.04 and 16.04 are still listed as vulnerable, with fixes in progress. Ubuntu says those fixes will come through its ESM archive for Ubuntu Pro users. AWS has released fixed kernels for Amazon Linux 2 and 2023. Red Hat lists RHEL 8, 9 and 10 as affected and says it is speeding up its fixes.

## What validators should do

- Install the fixed kernel through a normal package upgrade and **reboot**. The fix does not take effect until the machine runs the new kernel. AWS says a kernel update and reboot is "the only complete remediation for this issue."
- Plan the reboot so the validator does not miss its leader slots. A restart that runs long shows up as delinquent stake and skipped slots on the [Solana dashboard](https://bitbasic.com/solana).
- Until a host is patched, Ubuntu, AWS and Red Hat each describe a firewall rule that drops incoming IPv4 TCP packets with IP options, and AWS also suggests disabling Multipath TCP. All three say these steps reduce the risk but do not remove it.

The same kernel runs under validators on most networks, so operators elsewhere should check their hosts too.

Delegators have nothing to do. A validator that is slow to patch is still exposed, though, and delegators may want to check that their validator is still voting on its [BitBasic page](https://bitbasic.com/solana/validators).

## Sources

- [Ubuntu: CVE-2026-98432](https://ubuntu.com/security/CVE-2026-98432)
- [Ubuntu blog: Fixes for CVE-2026-98432](https://ubuntu.com/blog/fixes-available-in-proposed-pocket-for-cve-2026-98432)
- [AWS security bulletin 2026-160-AWS](https://aws.amazon.com/security/security-bulletins/2026-160-aws/)
- [Red Hat: RHSB-2026-016](https://access.redhat.com/security/vulnerabilities/RHSB-2026-016)
- [Unchained: Anza sounds the alarm for Solana validators on a Linux bug](https://unchainedcrypto.com/anza-sounds-the-alarm-for-solana-validators-on-a-linux-bug-ubuntu-hasnt-fixed/)
- [Anza: validator requirements](https://docs.anza.xyz/operations/requirements)