Amnezia VPN Users: Update Your Servers Immediately

A Threat to Server Owners

If you use Amnezia VPN and manage your own servers, it is time to take urgent security measures. The company has issued a warning regarding a critical vulnerability in the Linux kernel that threatens users who rely on the Xray protocol for server configuration. The flaw, identified as CVE-2026-98432, has been assigned a severity score of 9.8 out of 10 by security experts, highlighting its extremely dangerous nature.

Notably, users of Amnezia’s Premium, Free, and Business services do not need to take any action, as the company has already updated its infrastructure and conducted a security audit. However, for those hosting their own VPN servers, the situation is far more serious.

Why is the Xray Protocol Vulnerable?

This vulnerability concerns the processing of IPv4 TCP connections and has existed in the Linux kernel since version 4.4. The flaw is a so-called "race condition" that allows an attacker to improperly manipulate server memory. Tests conducted by Anthropic researchers demonstrated that by exploiting this vulnerability, it is possible to gain full control of a server in approximately 53 minutes, without the need for a password or any user interaction.

Those using the MPTCP (Multipath TCP) feature are at particular risk. Because Xray is written in the Go programming language, it automatically enables MPTCP, a detail that often goes unnoticed by server administrators. Consequently, their systems remain exposed to this type of cyberattack.

How to Secure Your Server

Amnezia VPN has published a three-step guide to resolve the issue. First, it is essential to update the application to version 5.1.0.6 or newer. After updating, you must follow these steps:

1. In the application, go to Settings > Servers, select the desired server, and temporarily remove Xray from the Protocols tab.
2. In the Management tab, select "Update server packages" and issue a server restart command. The restart is necessary to activate the updated, secure kernel version.
3. Return to the Protocols tab and reinstall Xray, which will now use the secure version 26.10.31.

It is important to remember that restarting the server will cause a temporary outage and existing connections will be dropped, meaning you will need to re-share access with users. If your operating system (such as certain versions of Ubuntu) has not yet received the final patch, the company recommends removing Xray from the server and switching to the UDP-based AmneziaWG protocol. Security in the digital space must be a priority, so do not delay this process.