Intersect, a member-based Cardano organization, urged stake pool operators to patch and reboot their block producers and relay servers as fixes become available for a critical Linux kernel vulnerability.
In its Oct. 30 update, Intersect told operators to check the kernels on both types of server and install their distribution’s fixed kernel as soon as it is published. The vulnerability, CVE-2026-98432, carries a CVSS 3.1 score of 9.8, or critical, from kernel.org.
The flaw affects the kernel’s handling of incoming IPv4 TCP connections. It can cause the kernel to access memory after it has been freed. Red Hat’s security bulletin says a remote attacker without credentials could exploit the race condition to execute code; its vulnerability description also identifies system crashes and memory corruption as risks.
For Cardano, the warning covers both the machines that produce blocks and the relays connecting them to the wider network. Cardano’s operator documentation recommends keeping block producers connected only to their own or trusted relays to shield them from the internet. Intersect’s advisory does not report exploitation against Cardano or quantify how many pools run vulnerable kernels.
Patches and Interim Measures
Ubuntu’s tracker, last updated Oct. 30, lists its standard kernels for Ubuntu 22.04, 24.04, 26.04 and 26.10 as vulnerable, with fixes in progress. Red Hat’s Oct. 30 bulletin lists RHEL 8, 9 and 10 as affected and says it is expediting fixes.
AlmaLinux said on Oct. 30 that patched kernels for its versions 8, 9 and 10 were available in testing repositories, ahead of production release. It said no fixed RHEL kernel was available at the time. The bug dates back to Linux 4.4, while upstream fixes have been backported to maintained stable branches.
The demonstrated attack used Multipath TCP, or MPTCP. Anthropic’s researchers said their proof of concept could send packets to a Linux server with an MPTCP listener and run commands as root, without credentials or user interaction. But the Go Security Team warned that the underlying bug is not specific to MPTCP, so systems without those listeners may also be vulnerable.
AlmaLinux advises disabling MPTCP where it is not needed and restarting services with existing MPTCP listeners: changing the setting alone stops only new MPTCP sockets from being created.
Red Hat also offers a firewall mitigation that filters incoming IPv4 TCP packets containing IP options. It warns operators to test the rule against their workloads before deployment and says filtering can reduce exposure but cannot fully prevent exploitation. Both vendors stress that interim measures do not replace installing a patched kernel; Intersect explicitly tells operators to reboot after updating.