Intersect, a member-based Cardano organization, urged stake pool operators to patch and reboot block producers and relay servers as fixes arrive for a critical Linux kernel vulnerability. Ubuntu fixes were still in progress as of Oct. 30, while AlmaLinux had patched kernels available for testing.
Intersect told stake pool operators on Oct. 30 to check the kernels on their block producers and relays and install their distribution's fixed kernel as soon as it is published. The vulnerability, CVE-2026-98432, carries a CVSS 3.1 score of 9.8, which is critical, from kernel.org.
The flaw affects how the kernel handles incoming IPv4 TCP connections, and it can cause the kernel to access memory after it has been freed. Red Hat's bulletin says a remote attacker without credentials could exploit the race condition to execute code. However, Intersect's advisory does not report exploitation against Cardano or quantify how many pools run vulnerable kernels.
Patches and interim measures
Ubuntu's tracker, last updated Oct. 30, lists its standard kernels for Ubuntu 22.04, 24.04, 26.04 and 26.10 as vulnerable, with fixes in progress. Red Hat's bulletin lists RHEL 8, 9 and 10 as affected and says it is expediting fixes.
AlmaLinux said that patched kernels for versions 8, 9 and 10 were available in testing repositories, ahead of production release. It added that no fixed RHEL kernel was available at the time.
Why MPTCP is not the whole story
The demonstrated attack used Multipath TCP, or MPTCP. Anthropic's researchers said their proof of concept could send packets to a Linux server with an MPTCP listener and run commands as root, without credentials or user interaction. But the Go Security Team warned that the underlying bug is not specific to MPTCP, so systems without those listeners may also be vulnerable.
AlmaLinux advises disabling MPTCP where it is not needed and restarting services with existing MPTCP listeners, because changing the setting alone stops only new MPTCP sockets from being created. Red Hat also offers a firewall mitigation that filters incoming IPv4 TCP packets containing IP options, though it says filtering can reduce exposure but cannot fully prevent exploitation.
Both vendors stress that interim measures do not replace installing a patched kernel, and Intersect explicitly tells operators to reboot after updating.
Source: The Defiant
Trading involves risk.
Risk Disclaimer
