Linux Kernel Critical Vulnerability Affects DeFi, Threshold Pauses tBTC Minting and Redemptions
- Core Viewpoint: Threshold Network has precautionarily paused tBTC minting and redemptions due to the Linux kernel critical vulnerability CVE-2026-98432. Reserves are sufficient, no fund losses have occurred, and tBTC has not shown significant depegging.
- Key Elements:
- The vulnerability is a Use-After-Free flaw in the Linux kernel IPv4 subsystem that can be triggered remotely to achieve code execution. Anthropic research shows that AI models have successfully constructed exploit programs.
- Threshold's cross-chain bridge wallet holds approximately 4,320 BTC (worth over $330 million), with about 4,185 tBTC in circulation, giving a reserve coverage ratio of approximately 103.2%.
- All node operators have either applied patches or gone offline, and no evidence has been found that the vulnerability was used to attack tBTC nodes.
- Aave has frozen approximately $137 million worth of tBTC deposit and borrowing operations.
- tBTC is trading at a discount of about 0.11% to BTC; on Uniswap, 1 tBTC can be exchanged for approximately 78,437 USDT, essentially maintaining its peg.
- While the redemption channel is paused, users can only rely on secondary market liquidity; restricted exit channels may pose liquidity discount risks.
- Threshold has not yet announced a definite restoration timeline and needs to complete security maintenance and confirm that nodes are running on patched systems.
Original | Odaily@OdailyChina)
Author | Golem (@web3_golem)
On October 31, the Bitcoin cross-chain protocol Threshold Network announced that it had suspended the minting and redemption functions of tBTC in response to the recently disclosed high-severity Linux kernel vulnerability, CVE-2026-98432.
The news quickly sparked market concerns over the security of tBTC assets. As a cross-chain asset backed 1:1 by BTC, tBTC's core value lies in enabling Bitcoin to enter ecosystems such as Ethereum to participate in DeFi activities like lending and liquidity mining. The simultaneous suspension of both the minting and redemption channels means users are temporarily unable to complete the two-way exchange between BTC and tBTC through the normal process.
On November 2, Threshold Network issued a further clarification, emphasizing that tBTC remains fully backed by reserves and that no funds have been lost so far. According to statistics, the Threshold Network cross-chain bridge wallet holds approximately 4,320 BTC, worth over $330 million, while the circulating supply of tBTC is about 4,185, meaning reserves exceed circulating supply by approximately 135 BTC. The team has also found no records of any unauthorized minting or transfers of tBTC.
tBTC minting and redemption on the Threshold Network website have been suspended
However, shortly after Threshold Network's announcement, Aave announced the suspension of new tBTC deposits and borrowing. Aave's website shows that the total tBTC reserves are worth approximately $137 million and are currently frozen.
Precautionary Measures Against CVE-2026-98432 Exploitation
The direct cause of the tBTC minting and redemption suspension is the recently disclosed Linux kernel vulnerability CVE-2026-98432.
According to a security advisory published by Red Hat on October 30, the vulnerability exists in the Linux kernel's IPv4 network subsystem and is a Use-After-Free vulnerability rated as "critical." During the concurrent processing of TCP connection requests, due to a race condition between memory release and access, an attacker could trigger memory corruption through carefully crafted network requests, potentially achieving remote code execution. This means an attacker could attempt to launch an attack over the network without obtaining local server privileges or requiring user interaction.
According to research disclosed by Anthropic on October 27, its internal AI model has successfully constructed an exploit for this vulnerability, achieving remote code execution on a Linux server running a Multipath TCP (MPTCP) listening service and obtaining a Root Shell with the highest privileges. The entire process does not require the attacker to obtain server login credentials in advance, nor does it require any action by the server administrator.
tBTC relies on distributed node operators to jointly manage the cross-chain Bitcoin reserves. An attacker could target the servers of tBTC node operators and potentially attempt to steal sensitive information from those servers, disrupt node operations, or even seek opportunities to obtain node signing permissions. As long as the attacker controls enough nodes, they could threaten the security of the cross-chain bridge, ultimately leading to the theft of user assets.
Threshold stated that, for security reasons, all tBTC node operators have either applied security patches to their servers or temporarily taken their nodes offline while awaiting the release of a fixed kernel version. Currently, the team has found no evidence that the vulnerability has been used to attack tBTC nodes.
Threshold's action this time is a precautionary measure rather than emergency loss mitigation after a confirmed attack. The suspension of minting and redemption is primarily to avoid continuing to process new cross-chain asset operations while node infrastructure has not yet completed security maintenance.
However, today Threshold's security report stated that approximately 0.5 ETH was transferred out of an Ethereum account used by a node operator to pay tBTC node transaction fees. This incident is unrelated to the Linux kernel vulnerability; the relevant node was already offline when it occurred, and the operator found no evidence that signing key material had been accessed.
On Threshold Network, the account that pays transaction fees is entirely distinct from the collective signatures required to move bridged Bitcoin. According to official documentation, transferring tBTC requires 51 of 100 signers to collaborate to generate a signature, and no single operator can move funds.
Has tBTC Depegged?
From the reserve data, the 4,320 BTC held in Threshold Network reserves correspond to approximately 4,185 tBTC in circulation, giving a reserve coverage ratio of about 103.2%, with a book reserve surplus of approximately 135 BTC.
But full reserves do not mean users can complete redemptions at any time. For holders, under normal circumstances they can exchange tBTC for BTC through the protocol, but while redemption is suspended, users can only seek liquidity through the secondary market. This means that even if the underlying assets are not lost, restricted exit channels could still produce a liquidity discount.
However, as of press time, tBTC has not shown any significant depegging. CoinGecko shows tBTC trading at approximately $78,460, while BTC is trading at approximately $78,520 on Binance, putting tBTC at a discount of about 0.11% to BTC and still basically maintaining its peg to BTC.
It should be noted that aggregated quotes are not equivalent to the actual execution price of large trades, especially with the redemption channel suspended, on-chain trading depth and slippage also deserve attention. As of press time, according to Uniswap data, 1 tBTC can be exchanged for 78,437 USDT or 78,360 USDC, and the price is roughly the same when exchanged for ETH.
For Threshold, what needs to be addressed now is not just the patching of the node server vulnerability, but also avoiding liquidity risks during the suspension period. As of press time, Threshold has not announced a specific recovery timeline, stating only that the cross-chain bridge will reopen after security maintenance is completed, nodes are back online, and it is confirmed that patched systems are in use. Still, the absence of any fund losses remains the most important piece of good news.
