Peter Bui Explain How one Linux Vulnerability fit Affect Cardano Stake Pools

Peter Bui, wey be host of Learn Cardano and operator of di ADAOZ stake pool, don check how one Linux kernel vulnerability fit affect di servers wey Cardano stake pool operators dey use.

For new video, Bui explain di roles of relays and block producers, wetin fit happen if pool lose network connection, and di difference between operator infrastructure and ADA wey delegators hold.

Him discussion follow one Intersect advisory wey ask operators to check dia servers for di vulnerability, wey dem identify as CVE-2026-98432, and to update affected systems once fixes don available.

How one Linux Vulnerability fit Disrupt one Cardano Stake Pool

Di flaw dey affect how di Linux kernel dey handle some network requests. People dey use Linux for many kain servers, including infrastructure wey stake pools dey depend on to communicate with Cardano and produce blocks.

Bui describe one timing error wey fit happen when TCP connection dey establish. Under some conditions, one part of di kernel fit release memory while another part still dey use am. Di error, wey dem dey call use-after-free, fit make system crash or spoil memory.

Di Linux kernel security team trace di issue go one change wey dem introduce for version 4.4. Dem don add fixes to maintained kernel branches, but availability for individual servers go depend on dia distribution and kernel package.

Stake pool dey typically use one block producer to create blocks when dem select am, and one or more relays to communicate with other Cardano nodes. Bui focus on di relays because dem dey accept network connections and dem fit dey exposed if dem dey run affected configuration.

If all di relays for one pool become unavailable, di block producer fit lose connection to di rest of di network. Bui explain say di producer fit still create scheduled block, but e no go fit transmit di block while communication path still down.

Wetin Attack fit Mean for Delegated ADA

Bui still consider scenario wey attacker gain control of one relay. Because di relay dey communicate with di block producer, di attacker fit possibly learn information about that connection, including di producer network address.

That information no go automatically give access to di block producer. Bui present am as possible starting point for further attack, and di outcome go depend on how di operator configure and protect di infrastructure. E discuss disruption of di producer and, for more serious scenario, compromise of systems or keys wey di operator control.

Di difference important for people wey dey delegate ADA. Delegation dey allow stake pool to use holder stake for di network block selection process, but di ADA still remain inside di holder wallet. If attacker compromise pool, e no go automatically give am control over di delegators funds.

Pool wey no fit publish scheduled blocks fit miss block production opportunities, and that one fit affect staking rewards. At di time wey dem record am, Bui never see reports say attacker don use this vulnerability attack any Cardano stake pool.

[NEWSBREAK]

Anthropic Demonstration and Available Fixes

Bui still discuss research from Anthropic, wey report say dia Claude model develop exploit for di Linux vulnerability. Anthropic describe one demonstration where remote attacker fit run commands with root privileges for server wey get Multipath TCP listener, without credentials or user interaction.

Multipath TCP, or MPTCP, na extension wey allow one connection to use multiple network paths. Di route wey Anthropic demonstrate involve server wey get that listener; di finding no mean say di same exploit go work against every affected Cardano node.

Di vulnerability itself dey inside how Linux dey handle network, e no be something wey limit to Cardano software. Ubuntu list am with CVSS 3.1 score of 9.8 out of 10, classify am as critical under that scoring system, and assign di issue high priority.

Intersect advise operators to check di kernels for both dia block producers and relays, install updated kernel when dia distribution provide am, and reboot make e take effect. Ubuntu advisory list fixes as in progress for several standard kernel packages, with status wey vary by release and package.

Bui mention disabling MPTCP where people no need am and filtering some IPv4 packets as temporary ways to reduce exposure. Those steps no dey correct di kernel flaw. Di permanent fix na updated kernel for di affected system.