A critical security flaw in Linux has raised concerns for Cardano's network and its staking ecosystem. The vulnerability, identified as CVE-2026-98432, was rated 9.8 out of 10 for severity by the Cardano coordinating group Intersect. The flaw affects Linux servers running versions dating back to 4.4, which are crucial for producing Cardano blocks. Hackers could exploit this bug to crash servers or, in some cases, take control without a password.
The flaw was publicly disclosed after Anthropic demonstrated an attack using multipath TCP, a networking feature. While no attacks on Cardano pools have been reported, the potential for disruption is significant. Roughly 21.5 billion ADA, about 58% of the circulating supply, is currently staked. Although hackers cannot steal ADA directly, they could disrupt staking rewards by taking servers offline.
Cardano has urged stake pool operators to patch the vulnerability promptly. However, patches are being rolled out unevenly. Linux upstream has already fixed the issue, but Ubuntu remains vulnerable with a fix in progress. Red Hat Enterprise Linux is awaiting a fix, while AlmaLinux has patched kernels in testing. The outcome depends on how quickly operators update and reboot their systems.
Last November, a separate bug briefly split Cardano into two chains, but no user funds were compromised. This latest warning focuses on the infrastructure running the network, highlighting the importance of proactive security measures.