Intersect Warns Cardano (ADA) Pool Operators of 9.8-Severity Linux Flaw

Intersect Warns Pool Operators

Intersect, the coordinating group behind Cardano (ADA) governance, warned stake pool operators on October 30 about a critical Linux vulnerability that could crash, or in some configurations hand control of, the servers that produce Cardano blocks. The flaw is tracked as CVE-2026-98432 and carries a CVSS severity score of 9.8 out of 10, with impact on kernels dating back to version 4.4, according to Intersect's weekly update. Linux underpins many of the machines that keep the blockchain running, and the bug works by letting specially crafted internet requests scramble how a server handles memory. A successful hit can crash the machine outright or, under certain configurations, give an outsider full access without needing a password. A 9.8 CVSS score places a bug in the most severe category reviewers assign, reserved for flaws exploitable remotely with little complexity.

The warning follows research Anthropic published on October 27, in which the company said its Claude AI system had developed an attack of this type against servers using multipath TCP, a networking feature that lets one connection travel over several paths at once. The automated test produced a working exploit in 53 minutes, the company's research post states. Public test code surfaced afterwards, though it fell short of demonstrating a complete takeover of a server. No attack on Cardano (ADA) pool infrastructure has been reported so far, and market data shows no established direct impact on the Cardano price. Most Cardano block producers run on Linux servers, which is why the advisory went to operators rather than to ordinary holders. The notice concerns the infrastructure layer rather than the ledger itself, but Intersect treated it as urgent enough to flag inside its weekly coordination update, and the network's block production runs through exactly the kind of Linux machines the bug targets.

Patching Lags on Ubuntu and Red Hat

The exposure runs through staking. Cardano's proof of stake design has holders delegate to pools that produce blocks and earn rewards, and about 21.5 billion ADA, roughly 58% of the circulating supply, sits delegated across the network right now. Coins never leave the owner's wallet under this arrangement, and Cardano's documentation states plainly that delegated Cardano (ADA) remains spendable at any time. A hijacked pool therefore does not hand an attacker ownership of its delegators' coins. An offline one is a different matter: the same documentation notes that poor pool performance decreases the rewards a pool and its members receive, so a server knocked out by this bug would dent payouts long before it ever touched principal. That scale of delegation is why the warning went to operators first: their uptime, not holders' wallet security, is where the flaw does its damage.

Patching has arrived unevenly across the distributions operators actually run. Upstream Linux carried a fix on October 5. Ubuntu remained vulnerable with a fix in progress as of October 30, Red Hat Enterprise Linux listed a fix as pending, and AlmaLinux had patched kernels still in testing. The spread matters because pool operators do not run a single standard image, so the same bug sits at different levels of exposure on different servers. Intersect has urged operators to check their servers, apply updates and reboot rather than assume their distribution is covered. The episode recalls last November, when a separate bug briefly split Cardano into two chains, an incident that also ended without compromised user funds. No stolen funds or lost rewards have been linked to the current flaw, and attention now turns to how quickly fixes roll out across Cardano pool infrastructure, where the delegated total makes uptime a direct economic question. Operators and delegators reviewing their setup can consult our guide to choosing a Cardano stake pool.

The open question is actual exposure, and nothing in the record settles it. The upstream kernel fix landed on October 5, yet as of October 30 the Ubuntu and Red Hat packages were still unpatched, which concentrates residual risk on operators running those distributions. No published count shows how many Cardano block producers have applied the fix, so the advisory and the absence of attacks stand together, each true so far as anyone has shown. What the episode clarifies is the shape of the risk: rewards and uptime, not custody, since delegators' coins sit in their own wallets regardless of what happens to a pool server. Intersect, which recently returned 115,172 ADA to the treasury in a mainnet first, now faces a coordination test of a different kind.