Self-Hosted Amnezia VPN Servers Face Critical Linux Kernel Flaw
Amnezia VPN warns that self-hosted servers running Xray face a critical Linux kernel flaw, while its managed plans need no action.
According to TechRadar, Amnezia VPN has warned people who run their own servers through its app that a critical flaw in the Linux kernel leaves those machines exposed. The vulnerability is tracked as CVE-2026-98432, and the company says operators using the Xray protocol need to rebuild their setups to stay protected.
TechRadar reports that the bug sits in the code Linux uses to accept new IPv4 TCP connections, and that it has been present since Linux 4.4. The kernel's security team has assigned it a severity score of 9.8 out of 10, placing it in the highest tier of seriousness.
Amnezia has published a three-step guide to help self-hosted operators protect their servers. The outlet notes that servers running Xray face the greatest risk. Users of Amnezia Premium, Free and Business do not need to take any action, according to the report.
TechRadar also points out that a VPN is only as secure as the machine it runs on. The report frames the advisory as a reminder that the software on the server, not just the app on a phone or laptop, determines how well users are protected.
Background
A virtual private network creates an encrypted tunnel between a user's device and a remote server, which then forwards traffic onward. People use VPNs for privacy on public networks, for access to resources based elsewhere, and in some regions to get around network restrictions. Commercial providers run their own servers, but a growing number of users deploy their own, often on rented cloud machines, to keep control over who handles their traffic.
Amnezia is an open-source project that offers a client application to set up VPN servers with a few clicks. Its appeal lies in simplifying a process that once required considerable technical skill. Xray is a separate open-source networking platform that supports several proxy protocols and is commonly used to disguise VPN traffic so that it resembles ordinary web traffic, which can help in places where such tools face blocking.
The Linux kernel is the core layer of the operating system, and its networking stack handles the low-level work of opening and managing connections. When a server listens for incoming TCP connections, the kernel accepts and processes them before any application sees the traffic. For this reason, flaws in this part of the kernel can be serious: they may be reachable over a network, sometimes without a user needing to log in.
Severity scores such as the 9.8 cited here follow the Common Vulnerability Scoring System, which rates issues from 0 to 10 based on factors like how easy an attack would be and how much damage it could cause. Scores in the 9 to 10 range are generally treated as critical. Vulnerability identifiers in the CVE format give security teams a shared name for each flaw, making it easier to track advisories and patches across vendors. Standard practice for kernel problems is to apply updates from the operating system distributor and reboot, since the running kernel does not change until the system restarts.
Why it matters
The episode highlights a responsibility shift that is easy to overlook. When a company runs servers on behalf of customers, it typically handles patching and configuration. When a person deploys their own server, they become the operator, and the security of their traffic depends on maintaining the entire stack, from the application down to the operating system. Many self-hosting guides focus on setup and say little about ongoing maintenance, so a critical kernel advisory can catch people unprepared.
The split between managed plans and self-hosted servers also matters for trust. Amnezia's statement that its own paid and free plans require no action is reassuring for most customers, but it underscores that protection differs depending on how the service is run. Users choosing between the two should understand that a self-hosted server is not automatically safer simply because it is theirs.
The flaw is also a reminder of how widely the Linux kernel is embedded. Because it powers a large share of servers, routers and cloud infrastructure, networking bugs in it can affect far more than VPN users. Projects that depend on it, including proxies, tunnels and hosting tools, inherit whatever risk lies in the code beneath them, and that makes timely disclosure and fast patching a shared concern across the open-source ecosystem.
Finally, the case shows the value of plain, actionable guidance. A three-step process gives operators a clear path, but its effectiveness depends on people actually reading and following it, especially those who may not think of their home-run or small-business server as a target.
What to watch
The most immediate question is how many self-hosted operators follow the guide and rebuild their configurations promptly. Adoption will vary, and many servers may sit unattended for long periods.
Readers should also watch for updates from Amnezia itself, including any revisions to its guidance or additional details about affected configurations. Clarity from the company will shape how operators judge their exposure.
Linux distributors and cloud providers are likely to publish kernel updates, and the timing of those releases will determine how quickly the fix reaches typical servers. Checking for security advisories from the operating system in use is the practical next step for anyone running a server.
Finally, watch whether other VPN and proxy projects that rely on the Linux networking stack issue their own advisories. Their responses will show whether this flaw is confined to one tool or reflects a broader exposure.
Viewpoints
Commentary from our columns: three angles on this story.
The Builder the engineer's view
Treat this as a kernel problem first and an app problem second. The flaw lives in the networking code that accepts incoming TCP connections, which means no amount of application-level tidying will close it. If you run a self-hosted Amnezia server, the sequence matters: update the kernel through your distribution's packages, reboot so the new kernel actually runs, and then confirm the version you are booted into. Many people stop after the package manager finishes and assume they are protected, but a running system keeps the old code until restart.
Next, inventory what is running on the machine. Xray configurations should be rebuilt as the vendor describes, not patched in place, because a clean setup removes leftover settings you may have forgotten. Keep a short written record of each server, its operating system, and its update schedule. Operators who manage several servers often find that one forgotten box is the weak point. The lesson extends beyond this advisory: anyone who deploys infrastructure owns its maintenance, and that work should be planned from the start rather than handled after an alarm.
The User what changes for people who use it
For most people, the practical message is simple, and it depends on how you use your VPN. If you subscribe to a managed Amnezia plan, the company says you do not need to do anything. That is a relief, but it is worth confirming the details on the official channels rather than relying on secondhand summaries. If you run your own server, the picture changes. You are now the person responsible for keeping it current, and the kernel update may feel like something you can postpone.
Think about who depends on that server. Perhaps it protects your household, a few colleagues, or a family member who does not know how it works. In those cases, ask someone in that group to take ownership of the update, or set a recurring reminder. A VPN is meant to make life more private and less worrying, and a neglected server can quietly undo that. Taking a single afternoon to follow the guide and reboot will likely be the most useful privacy step you take this year.
The Rulebook privacy, safety and regulation
This advisory raises a question that privacy promises often skip. A VPN sells protection, and users reasonably expect that protection to extend to their traffic from end to end. But the guarantee is only as strong as the server handling that traffic, and self-hosting moves much of that responsibility onto the individual. When a critical flaw appears in the operating system beneath the application, the person who deployed the server may not have the expertise or the habit to respond quickly, and the privacy they were counting on is only partly theirs to control.
Regulators and policymakers tend to focus on large providers, yet the self-hosted segment is growing precisely because people want less reliance on companies. That creates a gap in how vulnerability information reaches small operators. Clear, plain-language notices, direct communication through the app, and early warnings to users are all valuable. Openness about risk should be treated as a core obligation of any tool that promises privacy, whether it is run by a company or by a volunteer community, and users deserve to understand both the protection and its limits.