- Amnezia VPN has published a three-step guide to protect self-hosted servers from a critical Linux kernel flaw
- Servers running the Xray protocol face the highest risk
- Amnezia Premium, Free, and Business users don't need to do anything
Amnezia VPN has warned people who run their own servers through its app that a critical Linux kernel flaw leaves them exposed, and those using the Xray protocol need to rebuild their setups to stay safe.
The bug, tracked as CVE-2026-98432, sits in the code Linux uses to accept new IPv4 TCP connections and has been present since Linux 4.4. The kernel's security team gave it a severity score of 9.8 out of 10.
Even the best VPN is only as secure as the server it runs on, and that's the problem here. Amnezia VPN says its Premium, Free, and Business services are unaffected because the provider has already updated and audited its own infrastructure. Self-hosted users, however, have to act themselves.
Why Xray servers are most at risk
The flaw is what's known as a race condition — a software bug that tricks an operating system into mishandling its own memory during an internet connection. It was reported by Anthropic researcher Xinyang Ge, and on October 27, Anthropic said an unreleased Claude model had written a working exploit for it.
The attack targets servers using an advanced networking feature called MPTCP (Multipath TCP) — and that is where Xray comes in.
Xray is the engine behind censorship-resistant protocols like VLESS, and Amnezia rates it as high risk. Because Xray is built with a programming language called Go, it automatically enables MPTCP by default. As a result, server administrators could be leaving this vulnerability wide open in the background without ever realizing it.
: — A weekly newsletter on digital privacy and online surveillance. Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.
📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.
What self-hosted users should do
Amnezia's fix takes three steps and requires version 5.1.0.6 or later of the app.
That release adds a button to update packages on the server directly, which Amnezia says it built in response to this flaw. It follows the provider's Xray-core refresh in September and an earlier mandatory update for Premium and Free users.
In the app, go to , then , select your server, and from the Protocols tab.
Next, open the Management tab, choose Update server packages, and when prompted. The reboot is what loads the patched kernel.
Your server will go offline during the reboot, and existing Xray connections will stop working, so you'll need to share access with your users again.
The update button also doesn't guarantee a fixed kernel, and on some Ubuntu versions the patch is still only in the "-proposed" testing channel. Until a future app release fixes it, any later reboot leaves the server vulnerable again until you repeat the Xray reinstall.
If you can't patch the kernel yet, Amnezia suggests a firewall rule that blocks IP options, or removing Xray and switching to the UDP-based AmneziaWG.
Monica is a tech journalist with over a decade of experience. She writes about the latest developments in computing, which means anything from computer chips made out of paper to cutting-edge desktop processors.
GPUs are her main area of interest, and nothing thrills her quite like that time every couple of years when new graphics cards hit the market.
She built her first PC nearly 20 years ago, and dozens of builds later, she’s always planning out her next build (or helping her friends with theirs). During her career, Monica has written for many tech-centric outlets, including Digital Trends, SlashGear, WePC, and Tom’s Hardware.