Cardano stake pools hit by critical Linux flaw, delegated ADA stay safe

Intersect, the governance body behind Cardano, asked stake pool operators at the end of October to move their servers to a new Linux kernel. The request covers both types of machine in a pool: the block producer and the relays that connect it to the network. What is confirmed: the vulnerability is tracked as CVE-2026-98432, Ubuntu's security tracker lists it with a CVSS 3 score of 9.8 out of 10 and a "Critical" rating, and nobody has yet counted how many of the 2,884 registered Cardano pools run a vulnerable kernel. Our assessment follows further down: the flaw does not touch the balance of delegated ADA, but it can affect the rewards of the current epoch.

Intersect's Cardano stake pool warning, point by point

The notice went out to pool operators on October 30 and consists of three instructions any server administrator will recognise: check the running kernel on the block producer and the relays, install the fixed kernel as soon as your distribution ships it, and then reboot. A reboot is unavoidable with a kernel update, because the old kernel keeps running until then.

The warning explicitly presents two stopgaps as stopgaps rather than a fix: a firewall rule that drops the dangerous packets, and disabling MPTCP, an extension of the network protocol. Neither closes the hole in the kernel; they only narrow the path to it. Nobody has reported an attack on Cardano pool infrastructure so far, Intersect included.

How often Cardano calls on its operators to act in quick succession is clear from the previous week. When we reported on October 31, the vote on 9.6 million ADA from the treasury was still running until November 20, and the price stood just below $0.20. On Monday at midday ADA trades at $0.1906, down 6.3 percent over seven days and 21.4 percent over 30 days according to CoinGecko. The governance question from then is still open, and today's technical question comes on top.

CVE-2026-98432: the bug sits in the kernel's IPv4 handshake

A use-after-free is a programming error in which software accesses memory it has already released. What sits in that memory by then can, under certain conditions, be determined by an attacker, and that is where the danger lies.

Here it happens while incoming IPv4 connections are being set up. According to the description in the Ubuntu tracker, a child socket can be freed while its IP options are still being read, which leads to a use-after-free in the kernel function ip_options_build(). It is triggered by repeatedly sent SYN packets, the first packet of every connection setup, and by a request socket migrating between processes. The fix only releases the memory after a grace period. IPv6 is not affected by this first bug.

The score of 9.8 reflects the fact that the attack runs over the network, needs no login and does not require persuading anyone to cooperate. Ubuntu sets its own priority to "High". The bug has been in the kernel since version 4.4, in other words since early 2016, which makes it possible on practically every server kernel in production use.

How far it reaches is disputed. Anthropic reported on October 27 that an internal research model had built a working attack that gains root privileges remotely against an MPTCP service; the attack code has not been published. The CVE text itself describes the ordinary IPv4 path and does not mention MPTCP. Red Hat rates the flaw lower because the timing window is hard to hit. At the end of October it was not on the list of known exploited vulnerabilities kept by the US agency CISA.

Why delegated ADA stay in your own wallet

Delegation on Cardano works differently from many products that call themselves staking. You do not send coins to a pool. With your stake key you sign a certificate, the delegation certificate, which tells the network which pool may count your weight in block production. The ADA stay on your address, freely available, with no lock-up period.

That leads to the most important sentence in this article: a compromised pool cannot spend delegated ADA. A pool's keys allow it to sign blocks, not to move balances. Whoever gains control of a block producer can disrupt or halt block production, but cannot reach the delegators' wallets.

The damage therefore arises elsewhere. A pool that goes down misses the blocks the network has assigned to it for the current epoch. Missed blocks earn no reward, and that reward is shared between operator and delegators. An outage costs yield, not capital.

21.54 billion ADA across 2,884 pools: Cardano staking in epoch 665

How much weight depends on this infrastructure can be read from the Cardano blockchain itself. On Monday at midday we pulled the figures directly from the blockchain via the Koios interface rather than taking them from reports.

In the current epoch 665, 21,540,456,674 ADA are delegated, or roughly 21.54 billion. Against the 36.82 billion ADA in circulation, that is 58.5 percent of the entire supply; at Monday's price of $0.1906 it corresponds to a market value of around $4.1 billion. This weight is spread across 2,884 registered pools.

That number sits alongside a protocol value that rarely gets mentioned: the parameter k, which describes the target number of pools, is set at 500. There are almost six times as many pools as the reward model envisages. For the vulnerability this is good and bad news at once. The good part is that no single outage can shake the network, because block production is spread across many operators. The bad part is that many small pools are run by individuals in their spare time, and a kernel update at the weekend needs someone to install it.

The time frame is specific. Epoch 665 began on October 31 at 22:44 German time and ends on November 5 at the same hour. Whatever a pool misses in this epoch is fixed once it is over, because Cardano credits an epoch's rewards only two epochs later, about ten days afterwards. A redelegation made today also only takes effect at the next epoch boundary, not immediately.

The last completed settlement shows what is at stake. In epoch 662 the network distributed 6,146,980 ADA across 21.39 billion delegated ADA, which is 0.0287 percent per epoch or, on the basis of 73 epochs a year, 2.10 percent a year. For a position of 10,000 ADA that comes to just under 2.9 ADA per epoch, about 55 cents at Monday's price. If you want to compare providers and terms, the overview is in our hub on the best staking platforms.

Where the Linux distributions stand on the patch

Whether an operator can act at all depends on their Linux distribution. The picture is mixed, and that is the real reason the warning came before a finished patch.

AlmaLinux put fixed kernels into its testing repository on October 30: version 4.18.0-553.180.2.el8_10 for AlmaLinux 8, 5.14.0-687.61.2.el9_8 for AlmaLinux 9 and 6.12.0-211.69.2.el10_2 for AlmaLinux 10. In its own advisory on CVE-2026-98432 the project also describes the stopgaps, including an nftables rule that drops incoming IPv4 packets with an oversized header and does not survive a reboot, and a check on whether MPTCP is active at all.

Ubuntu looks different. The Ubuntu security tracker lists the kernels of 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS as vulnerable with work on a fix in progress, while 20.04, 18.04 and 16.04 are listed as vulnerable with no work under way. Only the old 14.04 is considered unaffected. At Red Hat the fix was still outstanding at the end of October.

For an operator this means: anyone running AlmaLinux could act at the weekend. Anyone running Ubuntu LTS, which is the most common case on server hardware, could only apply the stopgaps at the weekend and had to wait. That window is exactly why it makes sense to look at your own delegation now rather than in December.

Block output and saturation: two numbers in the pool profile

The state of your pool is shown in any Cardano explorer, and two values are enough to judge it.

The first is the block output of the current epoch, the number of assigned blocks against the number actually produced. A pool that the network assigned blocks to and that delivered none of them has a problem, regardless of whether the cause is a kernel, a disk failure or an expired certificate. With small pools, patience is in order: if a pool is allotted only one or two blocks in an epoch, a zero is possible even without a fault.

The second value is saturation. The parameter k of 500 and the 36.82 billion ADA in circulation give a saturation point of roughly 73.6 million ADA per pool. Above that limit the pool's rewards stop rising even though delegated weight keeps growing, and every additional ADA earns less there. On top comes the fixed fee per epoch, currently set at 170 ADA in the protocol. For a tiny pool it weighs proportionally far more than for a large one.

A third point is neither a number nor a metric, but it matters most today: does your operator answer a question about the kernel version, and do they say publicly what they are doing? Pools that maintain a channel or a status page can be checked on days like this. Pools with no trace online cannot.

Cardano staking in Germany: tax, holding period and custody

Two points that affect German investors when delegating; they have nothing to do with the vulnerability, but they apply to every change of pool.

For tax purposes, the Federal Finance Ministry's circular of March 6, 2025 classifies staking income as other income from services under Section 22 No. 3 of the Income Tax Act (EStG). An exemption limit of 256 euros per calendar year applies, and it covers all other income from services combined, not just staking. If the limit is exceeded, the entire amount becomes taxable, not just the part above it. At the annual yield of 2.10 percent that the blockchain shows for epoch 662, this limit only comes into view with a position of more than 60,000 euros.

The ADA themselves fall under Section 23 EStG with its one-year holding period, and delegating does not extend that period. We track what becomes of the planned reform on an ongoing basis in our status of the crypto holding period reform, since a cabinet decision is still missing. What matters for today's question: a redelegation is not a disposal. You do not move any coins, you sign a new certificate, and the holding period of your ADA keeps running.

On custody, the stake key stays with you. A hardware wallet can sign the delegation certificate itself, and the key never leaves the device in the process. Only the transaction fee of a few cents applies. If you stake through an exchange instead, you leave the choice of pool to the custodian, and this assessment does not apply there.

Our assessment: the risk lies with the rewards

Our assessment: this vulnerability is urgent for pool operators and, for delegators, mainly a question of yield. Three pieces of evidence support that. The score of 9.8 and the still unpatched kernels of the major Ubuntu LTS releases show that the problem on the server side is real and has not been cleared. Even so, no attack has been reported, and at the end of October the identifier was not on CISA's list of exploited vulnerabilities. And delegation itself gives a pool no right to move balances.

The counter-argument belongs in the same paragraph. If the path to root privileges described by Anthropic also works outside MPTCP, the issue is no longer just a relay going down but the takeover of machines that sign blocks. An attacker could then sabotage a pool's block production, have it double-sign and cause damage to the operator. Even then he would not get at the delegators' ADA, but an epoch without blocks is an epoch without rewards.

In numbers, the damage for a normal position stays small. If your pool misses an entire epoch, that costs around 2.9 ADA on 10,000 delegated ADA, about 55 cents at Monday's price. That is no reason to rush your delegation, but it is a good reason to check once where your weight sits. This is explicitly not a recommendation to buy or sell: ADA trades 93.8 percent below its all-time high of $3.09, and a total loss is possible with crypto assets at any time.

Linux flaw in the pools: epoch 665 ends on November 5

Until the epoch boundary on November 5 at 22:44 German time there is time to check calmly whether your weight sits in the right place. Three steps are enough.

1. Look up the pool. Open your pool's profile in an explorer and compare assigned against produced blocks in epoch 665. If it shows zero despite several assigned blocks, ask the operator about the kernel version. Alternatives and their fees are listed in our hub on the best staking platforms.
2. Check the keys. Make sure your stake key is with you and that the delegation certificate was signed on your own device. Which devices can do that is shown in our hardware wallet comparison.
3. Clarify custody. If your ADA sit on an exchange, you are not delegating yourself, and the custodian decides on the pool. How the providers handle this and what they charge is set out in our crypto exchange comparison.

(As of November 2, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)