(PwnEscape) Guest-to-Host KVM Escape [CVE-2026-99999]

What to do

• Check whether you use Akamai Cloud (Linode) in us. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 14d 21h it lasted.

  Anything that failed between 2026-10-15 17:27 UTC and 2026-10-30 15:06 UTC may need a replay.

• Subscribe to Akamai Cloud (Linode)'s feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=linode works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from Akamai Cloud (Linode) 4

1. identifiedOct 15, 2026, 5:27 PM UTC

   Akamai is aware of the recently published Guest-to-Host KVM Escape (CVE-2026-99999) vulnerability. Our teams have proactively identified its potential impact and are actively applying mitigations across our platform and infrastructure. There is potential for customer workload impact as a part of our platform response to this vulnerability. At this time, we have not observed evidence of this vulnerability being actively exploited on our platform. We will provide updates as additional information becomes available.

   provider

2. identifiedOct 16, 2026, 8:53 AM UTC

   We have not identified any exploitation on the Akamai platform so far. As of now, our subject matter experts are continuing to work on patching server sets in phases across the Akamai platform. We are actively monitoring our platform while we perform the mitigation actions.

   provider

3. identifiedOct 17, 2026, 5:07 AM UTC

   Akamai has completed patching Compute hypervisors for the known vulnerabilities related to CVE-2026-99999, also referred to as “PwnEscape”, and we have not identified any exploitation on the Akamai platform. We recommend that customers upgrade Linode guest VMs using kernels from upstream OS vendors as those become available, especially for cases where less trusted workloads are being run within containers or nested virtualization. We are in the process of preparing images containing fixes from upstream vendors.

   provider

4. resolvedOct 30, 2026, 3:06 PM UTC

   We have completed our investigation and response to the “PwnEscape” Guest-to-Host Escape vulnerability (CVE-2026-99999). We have published a documentation article with detailed guidance on available mitigations and recommended actions for affected systems: https://www.akamai.com/cloud/guides/cve-2026-99999-pwnescape-mitigation/ We encourage all customers to review the article and apply the appropriate mitigations to their environments. If you have questions or need assistance, please open a Support ticket, or contact us at 855-454-6633 (+1-609-380-7100 Intl.) / support@linode.com.

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.