Anthropic researcher Xinyang Ge found a critical vulnerability, CVE-2026-98432, in the Linux kernel. It was given 9.8 out of a possible 10 on the CVSSCommon Vulnerability Scoring System — a universal scale for rating the severity of cyberthreats scale by the Linux kernel developers.
It allows an attacker to remotely compromise a server with a listening TCP port, without a password. Among those under threat is Xray — one of the engines inside our client — since it enables MPTCPThe Multipath TCP extension, which lets a TCP connection be maintained over several channels at once by default.
In this article, we’ll explain who the bug affects and how to protect yourself.
Important: if you use Amnezia Premium, Free, and Business, you can breathe easy — you’re safe. But we don’t guarantee the reliability of other VPN services.
CVE-2026-98432 is a vulnerability in the Linux kernel itself, not in a specific VPN client or protocol. Any Linux server with an open TCP port is susceptible to it. If you use Amnezia Self-hosted, this article is most likely for you
What to Do
If You Use Premium, Free, or Business
As said above: nothing. We’ve already updated the infrastructure these plans’ users work with, checked it, and audited the servers.
Your data is safe
If You Use Self-hosted
Check whether you’re affected, and if so, update your server. In the coming days, we’ll release an updated Amnezia VPN client that will reinstall the Xray container with the fixed version 26.10.31.
To protect yourself right now, update the kernel through your distribution’s package manager — such as apt, dnf, or yum — to the version with the fix, and be sure to reboot the server.
Without a server reboot, the update won’t take effect!
Look for the fixed version in your distribution’s security tracker:
If you build the kernel from source, go by the upstream branches 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, and newer.
If you have no way to update the kernel, block IP Options. Paste this into the terminal:
sudo iptables -t raw -I PREROUTING -p tcp -m u32 --u32 “0>>24&0xF=6:15” -j DROPJust don’t forget to update the kernel when your vendor releases a patch. After that, roll out the patched version of Xray, 26.10.31.
If you can’t update the server, remove the Xray container and use a VPN protocol over UDP, such as AmneziaWG
Who the Vulnerability Affects
To repeat: the problem isn’t Xray as such. We single it out only because it works over TCP. If your server doesn’t use this protocol, the attack surface in your case is smaller.
We still advise updating the kernel — the server almost certainly has other listening TCP ports, SSH among them
Any Linux server is jeopardized — not only VPN servers but web, mail, SSH, and others — with an open TCP port. The breakdown by protocol is as follows:
- Servers with Xray (VLESS and others over TCP) are high-risk, since Go-based engines enable the MPTCP extension by default. It’s precisely through this that the vulnerability is exploited.
- Any other service on Linux with a listening TCP port is high-risk, whether it’s related to a VPN or not.
- Servers on WireGuard and AmneziaWG — run over UDP and have no listening TCP port for handling network traffic, but they’re susceptible to the vulnerability through other TCP ports, so updating the firmware is necessary for them too.
What This Vulnerability Even Is
CVE-2026-98432 is a memory-handling error in the part of the Linux kernel that processes incoming IPv4 TCP connections. It lets an attacker run commands with root privileges. An attack on the server requires no physical access to it, no password for it, and no action on the user’s part.
Anthropic representatives claim that the company created an exploit for CVE-2026-98432. They also clarify that they reproduced the attack on servers with a listening MPTCP socket. This, however, doesn’t mean that a disabled extension will protect you from compromise on its own.
What Amnezia Has to Do with It
Xray is one of the engines available within Amnezia VPN. Servers running it ended up exposed along with all other TCP services on Linux.
While on the Amnezia Premium, Free, and Business plans we control the infrastructure — promptly updating it and running audits — with Self-hosted, the server’s security is in your hands. You have to update it yourself, either manually or through the new version of the client.
Important: the patch won’t save you if attackers have already gained access to the server. Long-running servers will need not only a kernel update but also an audit
If You Use Another VPN
Since the vulnerability lives in the Linux kernel, not in a specific service, it concerns the servers of any VPN provider with a listening TCP port.
If the service’s representatives have publicly confirmed that they’ve updated the kernel, rebooted the servers, and audited for signs of compromise, then at least as far as CVE-2026-98432 goes, you can relax. Otherwise, you risk running into a data leak. A direct question to their support team will clear up any doubts.
What’s Next
We’re already preparing an update that will automatically replace containers with the outdated version of Xray. If you’re not ready to wait:
- Update the Linux kernel.
- Install the Xray 26.10.31 update.
- Reboot the server.
- Review the security basics for web servers.
13 min
