Intersect, a member-based Cardano group, urged stake pool operators to patch and reboot their block producers and relay servers as fixes turn into out there for a vital Linux kernel vulnerability.
In its Oct. 30 update, Intersect advised operators to verify the kernels on each sorts of server and set up their distribution’s mounted kernel as quickly as it’s revealed. The vulnerability, CVE-2026-98432, carries a CVSS 3.1 score of 9.8, or critical, from kernel.org.
The flaw impacts the kernel’s dealing with of incoming IPv4 TCP connections. It may possibly trigger the kernel to entry reminiscence after it has been freed. Red Hat’s security bulletin says a distant attacker with out credentials might exploit the race situation to execute code; its vulnerability description additionally identifies system crashes and reminiscence corruption as dangers.
For Cardano, the warning covers each the machines that produce blocks and the relays connecting them to the broader community. Cardano’s operator documentation recommends conserving block producers linked solely to their very own or trusted relays to protect them from the web. Intersect’s advisory doesn’t report exploitation in opposition to Cardano or quantify what number of swimming pools run susceptible kernels.
Patches and Interim Measures
Ubuntu’s tracker, final up to date Oct. 30, lists its normal kernels for Ubuntu 22.04, 24.04, 26.04 and 26.10 as susceptible, with fixes in progress. Purple Hat’s Oct. 30 bulletin lists RHEL 8, 9 and 10 as affected and says it’s expediting fixes.
AlmaLinux said on Oct. 30 that patched kernels for its variations 8, 9 and 10 had been out there in testing repositories, forward of manufacturing launch. It stated no mounted RHEL kernel was out there on the time. The bug dates again to Linux 4.4, whereas upstream fixes have been backported to maintained steady branches.
The demonstrated assault used Multipath TCP, or MPTCP. Anthropic’s researchers said their proof of idea might ship packets to a Linux server with an MPTCP listener and run instructions as root, with out credentials or consumer interplay. However the Go Security Team warned that the underlying bug shouldn’t be particular to MPTCP, so techniques with out these listeners can also be susceptible.
AlmaLinux advises disabling MPTCP the place it’s not wanted and restarting companies with current MPTCP listeners: altering the setting alone stops solely new MPTCP sockets from being created.
Purple Hat additionally gives a firewall mitigation that filters incoming IPv4 TCP packets containing IP choices. It warns operators to take a look at the rule in opposition to their workloads earlier than deployment and says filtering can cut back publicity however can’t absolutely forestall exploitation. Each distributors stress that interim measures don’t substitute putting in a patched kernel; Intersect explicitly tells operators to reboot after updating.
