Peter Bui Explains How a Linux Vulnerability Could Affect Cardano Stake Pools

Peter Bui, host of Learn Cardano and operator of the ADAOZ stake pool, has examined how a Linux kernel vulnerability could affect the servers used by Cardano stake pool operators.

In a new video, Bui explains the roles of relays and block producers, the consequences of losing a pool’s network connection, and the distinction between an operator’s infrastructure and ADA held by delegators.

His discussion follows an Intersect advisory asking operators to check their servers for the vulnerability, identified as CVE-2026-98432, and update affected systems when fixes become available.

How a Linux Vulnerability Could Disrupt a Cardano Stake Pool

The flaw affects the Linux kernel’s handling of certain network requests. Linux is used across many types of servers, including infrastructure that stake pools rely on to communicate with Cardano and produce blocks.

Bui describes a timing error that can occur while a TCP connection is being established. Under certain conditions, one part of the kernel can release memory while another part is still using it. The error, known as a use-after-free, can lead to a system crash or memory corruption.

The Linux kernel security team traces the issue to a change introduced in version 4.4. Fixes have been added to maintained kernel branches, while availability for individual servers depends on their distribution and kernel package.

A stake pool typically uses a block producer to create blocks when selected and one or more relays to communicate with other Cardano nodes. Bui focuses on the relays because they accept network connections and may be exposed if they run an affected configuration.

If all of a pool’s relays became unavailable, its block producer could lose its connection to the rest of the network. Bui explains that the producer might still create a scheduled block, but it would be unable to transmit that block while the communication path was down.

What an Attack Could Mean for Delegated ADA

Bui also considers a scenario in which an attacker gains control of a relay. Because the relay communicates with the block producer, the attacker could potentially learn information about that connection, including the producer’s network address.

That information would not automatically provide access to the block producer. Bui presents it as a possible starting point for a further attack, with the outcome depending on how the operator has configured and protected the infrastructure. He discusses disruption of the producer and, in a more serious scenario, compromise of systems or keys controlled by the operator.

The distinction matters for people who delegate ADA. Delegation allows a stake pool to use a holder’s stake in the network’s block selection process, but the ADA remains in the holder’s wallet. A compromised pool would not automatically give an attacker control of its delegators’ funds.

A pool that cannot publish scheduled blocks may, however, miss block production opportunities, which can affect staking rewards. At the time of recording, Bui had not seen reports of a Cardano stake pool being attacked through this vulnerability.

[NEWSBREAK]

Anthropic’s Demonstration and Available Fixes

Bui also discusses research by Anthropic, which reported that its Claude model developed an exploit for the Linux vulnerability. Anthropic described a demonstration in which a remote attacker could run commands with root privileges on a server with a Multipath TCP listener, without credentials or user interaction.

Multipath TCP, or MPTCP, is an extension that allows a connection to use multiple network paths. Anthropic’s demonstrated route involved a server with that listener; the finding does not establish that the same exploit would work against every affected Cardano node.

The vulnerability itself is in Linux’s network handling and is not limited to Cardano software. Ubuntu lists it with a CVSS 3.1 score of 9.8 out of 10, classified as critical under that scoring system, while assigning the issue a high priority.

Intersect advised operators to check the kernels on both their block producers and relays, install an updated kernel when their distribution provides one, and reboot so it takes effect. Ubuntu’s advisory listed fixes as in progress for several standard kernel packages, with status varying by release and package.

Bui mentions disabling MPTCP where it is not needed and filtering certain IPv4 packets as temporary ways to reduce exposure. Those steps do not correct the kernel flaw. The permanent fix is an updated kernel for the affected system.