Running your own Amnezia VPN server? You need to patch this critical Linux flaw now

Amnezia VPN has published a three-step guide to protect self-hosted servers from a critical Linux kernel flaw Servers running the Xray protocol face the highest risk Amnezia Premium, Free, and Business users don't need to do anything Amnezia VPN has warned people who run their own servers through it

<![CDATA[ <article> <ul><li><strong>Amnezia VPN has published a three-step guide to protect self-hosted servers from a critical Linux kernel flaw</strong></li><li><strong>Servers running the Xray protocol face the highest risk</strong></li><li><strong>Amnezia Premium, Free, and Business users don't need to do anything</strong></li></ul><p>Amnezia VPN has warned people who run their own servers through its app that a critical Linux kernel flaw leaves them exposed, and those using the Xray protocol need to rebuild their setups to stay safe.</p><p>The bug, tracked as CVE-2026-98432, sits in the code Linux uses to accept new IPv4 TCP connections and has been present since Linux 4.4. The <a href="https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html" target="_blank" rel="nofollow">kernel's security team</a> gave it a severity score of 9.8 out of 10.</p><p>Even the <a href="https://www.techradar.com/vpn/best-vpn">best VPN</a> is only as secure as the server it runs on, and that's the problem here. <a href="https://www.techradar.com/vpn/amnezia-vpn-review-year">Amnezia VPN</a> says its Premium, Free, and Business services are unaffected because the provider has already updated and audited its own infrastructure. Self-hosted users, however, have to act themselves.</p><div class="product"><a data-dimension112="bc9d4190-dd2b-11f1-8d97-13ae8d977a76" data-action="Deal Block" data-label="Amnezia VPN — censorship-resistant VPN" data-dimension48="Amnezia VPN — censorship-resistant VPN" href="https://pay.amnezia.org/amnezia-premium/?utm_source=x&amp;utm_campaign=blog_x_UP29_07_26&amp;m_vid=e59a4396c7895187" target="_blank" rel="nofollow"><figure class="van-image-figure " ><div class='image-full-width-wrapper'><div class='image-widthsetter' style="max-width:597px;"><p class="vanilla-image-block" style="padding-top:100.00%;"><img id="ACV243wPtwVxT5MsrphvZQ" name="AmneziaVPN" caption="" alt="" src="https://cdn.mos.cms.futurecdn.net/ACV243wPtwVxT5MsrphvZQ-1920-80.png" mos="" align="middle" fullscreen="" width="597" height="597" attribution="" endorsement="" credit="" class="" /></p></div></div></figure></a><p><a href="https://pay.amnezia.org/amnezia-premium/?utm_source=x&amp;utm_campaign=blog_x_UP29_07_26&amp;m_vid=e59a4396c7895187" target="_blank" rel="nofollow" data-dimension112="bc9d4190-dd2b-11f1-8d97-13ae8d977a76" data-action="Deal Block" data-label="Amnezia VPN — censorship-resistant VPN" data-dimension48="Amnezia VPN — censorship-resistant VPN" data-dimension25=""><strong>Amnezia VPN — censorship-resistant VPN</strong></a><br />Amnezia VPN is an affordable, privacy-focused service that prioritizes essentials like security and censorship unblocking over unnecessary extras. All its apps are open-source, albeit more basic than some competitors. It offers both Free and Premium protection, with the latter billed at $28 for six months and $48 for a year. You have 14 days to decide if you like it or not, risk-free, thanks to its money-back guarantee. <a class="view-deal button" href="https://pay.amnezia.org/amnezia-premium/?utm_source=x&amp;utm_campaign=blog_x_UP29_07_26&amp;m_vid=e59a4396c7895187" target="_blank" rel="nofollow" data-dimension112="bc9d4190-dd2b-11f1-8d97-13ae8d977a76" data-action="Deal Block" data-label="Amnezia VPN — censorship-resistant VPN" data-dimension48="Amnezia VPN — censorship-resistant VPN" data-dimension25="">View Deal</a></p></div><h2 id="why-xray-servers-are-most-at-risk">Why Xray servers are most at risk</h2><p>The flaw is what's known as a race condition — a software bug that tricks an operating system into mishandling its own memory during an internet connection. It was reported by Anthropic researcher Xinyang Ge, and on October 27, <a href="https://www.anthropic.com/research/discovering-vulnerabilities-with-claude" target="_blank" rel="nofollow">Anthropic said</a> an unreleased Claude model had written a working exploit for it. </p><p>With zero user interaction and no passwords needed, the exploit could fully take over a vulnerable server in roughly 53 minutes.</p><p>The attack targets servers using an advanced networking feature called MPTCP (Multipath TCP) — and that is where Xray comes in. </p><p>Xray is the engine behind censorship-resistant protocols like VLESS, and Amnezia rates it as high risk. Because Xray is built with a programming language called Go, it automatically enables MPTCP by default. As a result, server administrators could be leaving this vulnerability wide open in the background without ever realizing it.</p><a href="https://x.wayin.com/display/container/dc/efe848be-588a-4e20-8711-6e02de64b315/details"><figure class="van-image-figure inline-layout" data-bordeaux-image-check="" ><div class='image-full-width-wrapper'><div class='image-widthsetter' style="max-width:1200px;"><p class="vanilla-image-block" style="padding-top:26.17%;"><img id="Z7QHFc4GHoMhdps5XmntoC" name="LNT-masthead" alt="Leave No Trace logo" src="https://cdn.mos.cms.futurecdn.net/Z7QHFc4GHoMhdps5XmntoC-1920-80.png" mos="" align="middle" fullscreen="" width="1200" height="314" attribution="" endorsement="" class="inline" /></p></div></div><figcaption itemprop="caption description" class=" inline-layout"><span class="credit" itemprop="copyrightHolder">(Image credit: Future)</span></figcaption></figure></a><p><strong>NEW</strong>: <a href="https://x.wayin.com/display/container/dc/efe848be-588a-4e20-8711-6e02de64b315/details" target="_blank" rel="nofollow"><strong>Leave No Trace</strong></a> — A weekly newsletter on digital privacy and online surveillance. Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.</p><p>📩 <a href="https://x.wayin.com/display/container/dc/efe848be-588a-4e20-8711-6e02de64b315/details">Subscribe now</a> to get every edition delivered to your inbox every Friday, launching this September.</p><h2 id="what-self-hosted-users-should-do">What self-hosted users should do</h2><p>Amnezia's fix takes three steps and requires version 5.1.0.6 or later of the app. </p><p>That release adds a button to update packages on the server directly, which Amnezia says it built in response to this flaw. It follows the provider's <a href="https://www.techradar.com/vpn/vpn-privacy-security/amnezia-vpn-boosts-stability-of-all-apps-with-a-new-update">Xray-core refresh in September</a> and an earlier <a href="https://techradar.com/vpn/vpn-privacy-security/amnezia-vpn-strengthens-its-blocking-capabilities-with-mandatory-update-for-premium-and-free-users">mandatory update</a> for Premium and Free users.</p><div class="see-more see-more--clipped"><figure><blockquote class="twitter-tweet hawk-ignore" data-lang="en" cite="https://twitter.com/cantworkitout/status/2118650553332801774"><p lang="en" dir="ltr">🔒 Urgent Security Update for Xray ServersFixed the Linux vulnerability CVE-2026-98432? We’ve put together a step-by-step guide to help you update system packages, reinstall Xray, and secure your self-hosted server.Don’t delay — protect your server today: https://t.co/APqgAGanlw<a href="https://twitter.com/cantworkitout/status/2118650553332801774">November 6, 2026</a></p></blockquote></figure><div class="see-more__filter"></div></div><p>In the app, go to <strong>Settings</strong>, then <strong>Servers</strong>, select your server, and <strong>remove Xray</strong> from the Protocols tab.</p><p>Next, open the <strong>Management tab</strong>, choose <strong>Update server packages</strong>, and <strong>reboot</strong> when prompted. The reboot is what loads the patched kernel.</p><p>Return to the Protocols tab and <strong>install Xray again</strong>, which now uses the patched version 26.10.31.</p><p>Your server will go offline during the reboot, and existing Xray connections will stop working, so you'll need to share access with your users again. </p><p>The update button also doesn't guarantee a fixed kernel, and on some Ubuntu versions the patch is still only in the "-proposed" testing channel. Until a future app release fixes it, any later reboot leaves the server vulnerable again until you repeat the Xray reinstall.</p><p>If you can't patch the kernel yet, Amnezia suggests a firewall rule that blocks IP options, or removing Xray and switching to the UDP-based AmneziaWG.</p><div data-widget-type="multimodelreview" data-model-name="NordVPN,Surfshark,Proton VPN" data-widget-title="Today's best VPN deals"></div> </article> ]]>