PwnEscape Linux kernel vulnerability: UpCloud’s response

Last updated: 7:32 AM UTC, October 23, 2026

UpCloud fully mitigated this vulnerability on October 21, 2026.

About the vulnerability

UpCloud has successfully applied mitigations to the recently disclosed PwnEscape vulnerability (CVE-2026-99999) in the Linux kernel. The vulnerability concerns access to host memory from a guest virtual machine, with a full guest-to-host escape demonstrated in a controlled research environment.

Our security and engineering teams have been closely monitoring the situation. We have not identified any evidence of active exploitation of this vulnerability on UpCloud systems.

Affected products

This vulnerability affected Cloud Server, Private Cloud and GPU Server products.

Mitigating actions

Cloud Servers: We have successfully applied mitigations to this vulnerability and actively deployed these updates across our platform and whole infrastructure. Mitigations were applied with the help of live migrations, minimizing any customer impact.

GPU Servers: Due to their architecture, GPU servers cannot be live-migrated. These servers had to be shut down and restarted to apply the upgrade, which resulted in a downtime of approximately 30 to 60 minutes.

Private Clouds: We will communicate the relevant details directly to affected Private Cloud customers.

No direct action is required from customers. We always recommend users to keep their servers up-to-date with software updates.

If you have questions or concerns, please contact our Support team.