Hello Validator Operators,
We wanted to bring to your awareness a critical Linux kernel vulnerability that may affect infrastructure supporting Canton Network validators.
CVE-2026-98432 is a critical severity (CVSS 9.8) use-after-free vulnerability in the Linux kernel's IPv4 TCP networking stack. Under certain conditions, an unauthenticated remote attacker could exploit this vulnerability, potentially resulting in a system crash, memory corruption, or remote code execution with root privileges.
This is an underlying operating system vulnerability, not a Canton-specific issue. Validators running on affected Linux hosts may be exposed even if their Canton applications and containers are fully up to date.
Recommended actions:
- Review your validator infrastructure and determine whether any hosts are running affected Linux kernel versions.
- Apply the latest security patches from your operating system or infrastructure provider and reboot affected hosts as required.
- Where patches are not yet available, review and implement the temporary mitigations recommended by your infrastructure provider.
- Ensure that your infrastructure and security teams are aware of the vulnerability and assessing potential exposure.
References:
We wanted to remind you of the importance of acting on this vulnerability, which has been widely reported. It has no direct relation to Canton, but given the wide range of operating environments across Canton Validator nodes, we thought it might be helpful to remind you of this issue and how important it is for each operator to take steps to mitigate it.
