Cardano infrastructure coordinators have warned stake pool operators to address a high-severity Linux kernel vulnerability that could disrupt servers used to produce blocks on the network. The flaw, tracked as CVE-2026-98432, carries a CVSS severity score of 9.8 and affects Linux kernels going back to version 4.4.
The warning centers on the systems many Cardano pools rely on rather than on users’ wallets. Intersect said the bug could be triggered through specially crafted internet requests that confuse memory handling, potentially crashing a machine or, in some configurations, allowing an outsider to take control without a password. Public test code has appeared, although it has not shown a full takeover.
Why the flaw matters for Cardano
The issue has drawn attention because Linux powers a large share of the servers involved in Cardano block production. If a pool’s server is taken offline, that pool may miss blocks and its performance can deteriorate.
The warning comes as roughly 21.5 billion ADA, or about 58% of the circulating supply, is staked on the network. That has raised broader concern about whether a server-level weakness could affect delegators and staking activity if enough operators fail to patch in time.
What is and is not at risk
Cardano’s staking design limits the direct exposure of delegated funds. ADA delegated to a pool remains in the holder’s own wallet and can still be spent, meaning a compromised pool server would not by itself give an attacker control over delegators’ coins.
The more immediate risk is operational. If an affected pool performs poorly or stops producing blocks, the number of rewards earned by the pool and its delegators could fall. Cardano has not linked this flaw to any confirmed theft of funds or to any documented loss of rewards so far.
The source article also noted that ADA’s market price could come under pressure if disruption became widespread, but it did not establish any direct market effect from the vulnerability.
Patch rollout remains uneven
Intersect has told operators to inspect their systems, apply available updates, and reboot affected servers. Fixes, however, are not arriving at the same pace across Linux distributions.
According to the status cited in the report for Oct. 30, the upstream Linux fix was released on Oct. 5. Ubuntu was still listed as vulnerable with a fix in progress, Red Hat Enterprise Linux had a fix pending, and AlmaLinux had patched kernels in testing.
Next step for operators and network context
The immediate confirmed step is straightforward: stake pool operators need to verify whether their infrastructure uses affected kernels and install vendor patches as they become available. The outcome for the network depends largely on how quickly those updates are deployed.
The report also pointed to a separate Cardano incident last November, when another bug briefly split the network into two chains. No user funds were compromised in that event. In the current case, the concern is again focused on network infrastructure rather than direct loss of users’ ADA.
Source: beincrypto.com