Linux Kernel Bug Exposes Self-Hosted VPN Servers

A critical vulnerability, identified as CVE-2026-98432, has been discovered in the Linux kernel, posing a significant risk to self-hosted Amnezia VPN servers. This flaw, present since Linux 4.4, affects how the kernel handles new IPv4 TCP connections and has been assigned a severe rating of 9.8 out of 10. The vulnerability is a race condition that can allow an attacker to take complete control of a server within approximately 53 minutes, with no user interaction required.

Servers running the Xray protocol are especially susceptible because Xray, used for censorship-resistant protocols like VLESS, is built with Go and automatically enables Multipath TCP (MPTCP) by default. This default configuration can leave the vulnerability exposed without administrators being aware. Amnezia VPN has stated that its own Premium, Free, and Business services are unaffected as they have already secured their infrastructure.

Users operating their own Amnezia servers must follow a three-step procedure to mitigate this risk. This involves updating the Amnezia app to version 5.1.0.6 or later, removing the Xray protocol, updating server packages, rebooting to load the patched kernel, and then reinstalling Xray. This process will temporarily take servers offline and necessitate re-sharing access with users. Amnezia also suggests alternative solutions, such as implementing firewall rules or switching to AmneziaWG, if the kernel patch cannot be immediately applied.