Ubuntu-based Solana validators urged to block traffic while kernel fix waits

On Nov. 2, Solana developer Anza sent an action-required alert to Solana mainnet-beta validators about CVE-2026-98432, a critical Linux kernel flaw Ubuntu has not patched. Tim Garcia, the Solana Foundation’s validator relations lead, advised Ubuntu operators to use nftables to drop inbound TCP packets with IPv4 options and disable Multipath TCP and TCP request-socket migration until an Ubuntu package is available. The flaw is a use-after-free in kernel IPv4 code that can let the kernel read freed memory during TCP connection handling; it has a CVSS score of 9.8 and an Ubuntu priority of High. It is patched upstream, but Canonical’s tracker lists main kernel packages for several Ubuntu releases as vulnerable work in progress.