Cardano’s governance organization Intersect issued a warning on October 30 about a critical Linux kernel vulnerability identified as CVE‑2026‑98432. The flaw, rated 9.8 out of 10 on the CVSS scale, affects kernel versions dating back to 4.4 and could allow specially crafted network requests to cause memory corruption, potentially crashing the server or enabling remote code execution without authentication.
Potential impact on staking
Cardano’s staking model lets holders delegate ADA to a pool without transferring ownership of the tokens. While a compromised pool server would not give attackers direct access to delegators’ funds, a disruption could reduce block production and consequently lower staking rewards for pool participants.
Current status of attacks
To date, no attacks on Cardano stake pools have been reported, and there have been no incidents of stolen funds or reward losses linked to this vulnerability.
Patch rollout
Intersect urged pool operators to verify their server configurations, apply the available patches, and reboot the affected systems. Patch availability varies by distribution: the upstream Linux kernel was fixed on October 5, Ubuntu patches are in progress, Red Hat Enterprise Linux fixes are pending, and AlmaLinux kernels are being tested.
Historical context
Last November, Cardano experienced a separate software bug that temporarily split the blockchain into two chains, though no user funds were compromised. The present warning concerns the underlying infrastructure rather than the protocol itself.
Outlook
Continued monitoring and timely patching are essential to maintain network stability and protect staking rewards. The broader market impact will depend on the extent of any service disruptions.
