Xray ships an urgent update over a Linux kernel vulnerability

In late October a vulnerability in the Linux kernel, CVE-2026-98432, became public. It is a use-after-free bug, meaning the kernel can touch memory it has already released, in the handling of incoming IPv4 TCP connections. According to Amazon Web Services, it affects kernels from version 4.4 onwards. Red Hat rates it as critical, and the Russian security site SecurityLab.ru reports a CVSS score of 9.8 out of 10.

A research team at Anthropic demonstrated how dangerous the bug is in practice. According to its report, an unreleased internal Claude model wrote an exploit that lets a remote attacker run commands as root, with no password, on a Linux server that accepts Multipath TCP (MPTCP) connections. In the demonstration it took 48 minutes to get past the kernel's defences and about five more to run commands.

Xray, a popular open-source proxy server, is affected because it is written in Go. Since Go 1.24, Go server programs on Linux accept MPTCP connections by default, so Xray servers became one of the ways in. Xray 26.10.31 turns MPTCP off by default, and the previous release, 26.10.29, has been withdrawn. The developers urge users to update both Xray and the Linux kernel as soon as possible: the bug itself is in the kernel, and the Xray update only narrows the attack surface.

The Xray developers say Android clients built on Xray are also at some risk if their SOCKS or HTTP inbound allows connections from the local network. SecurityLab.ru notes that simply having an Xray-based app on a phone does not make it open to a remote takeover.

What is known about the fixes

According to Anthropic, the kernel fix has been backported to all maintained stable branches. Patched kernels are already out for Debian 12 and 13 and for Amazon Linux 2 and 2023, and Red Hat is preparing updates for RHEL 8, 9 and 10.
A server has to be rebooted after the new kernel is installed, otherwise the fix does not take effect, AWS warns.
Where no update is available yet, AWS suggests turning off MPTCP system-wide as a stopgap. This blocks the path used in the demonstration but does not remove the bug itself.
AWS says it is not aware of the vulnerability being exploited in real attacks.

All Byte VPN servers have already been moved to Xray 26.10.31.