Solana validators Linux flaw rated 9.8 waits for Ubuntu fix

Solana validators Linux flaw rated 9.8 still waits for an Ubuntu fix

Ubuntu still had no fixed kernel for a Linux flaw rated 9.8 out of 10 at 7:58 a.m. ET on Nov. 2, as Solana validators were told to act.

The quick take

Price: $SOL traded at $94.11 at 7:48 a.m. ET, down 0.7% in 24 hours, per CoinGecko.
Trigger: Anza told Solana validators on Nov. 1 to act at once against CVE-2026-98432, a remote-takeover bug.
Watch: Ubuntu’s fixed kernel for version 24.04, listed as 6.8.0-149.149, and how fast validators install it.

What happened

Node operators on Solana ($SOL) are on alert. The Solana validators Linux flaw, tracked as CVE-2026-98432, is rated 9.8 out of 10 for severity on Ubuntu’s security tracker. Anza, a Solana software developer, warned mainnet validators on Nov. 1 to act immediately, CryptoSlate reported.

The bug sits in the way the Linux kernel handles IPv4 TCP connections. Ubuntu describes it as a use-after-free error, a memory mistake that attackers can abuse. Its tracker gives the flaw a “high” Ubuntu priority.

Tim Garcia, who leads validator relations at the Solana Foundation, put it plainly: “Validators! CVE-2026-98432 is patched in the linux kernel but not yet patched on ubuntu.”

Ubuntu matters here because Anza’s validator requirements name Ubuntu 24.04 and a public IPv4 address, according to CryptoSlate. How exposed a node is comes down to its kernel version and network settings. CryptoSlate found no evidence that any Solana validator has been hacked through the flaw.

The risk became concrete on Oct. 27. Anthropic said an unreleased Claude research model wrote a working exploit that ran commands as root on Linux servers with a Multipath TCP (MPTCP) listener. The attack took about 53 minutes, the company said, as cited by CryptoSlate.

What to watch next

Until a fix ships, Garcia advised operators to block incoming TCP packets that carry IPv4 options, switch off MPTCP and disable request-socket migration for TCP. Red Hat has cautioned that filtering traffic cannot fully remove the risk, per CryptoSlate.

At 7:58 a.m. ET on Nov. 2, Ubuntu still listed its main kernel for 24.04 as vulnerable, with work in progress on version 6.8.0-149.149. Amazon Linux 2 and Amazon Linux 2023 already have corrected kernels, CryptoSlate reported. Operators then need to install the update and reboot.

$SOL was down 7.2% over seven days, per CoinGecko, and apps on Solana held $5.5 billion in deposits, DefiLlama data shows.

Bottom line: The flaw is serious and the fix is known; what counts now is how fast Ubuntu ships it and validators install it.

Price data: CoinGecko (cross-checked with Jupiter)