PwnEscape Linux kernel vulnerability: UpCloud’s response

Last updated: 7:27 PM UTC, October 16, 2026

About the vulnerability

UpCloud is working to address and mitigate the recently disclosed PwnEscape vulnerability (CVE-2026-99999) in the Linux kernel. The vulnerability concerns access to host memory from a guest virtual machine, with a full guest-to-host escape demonstrated in a controlled research environment.

Our security and engineering teams have been closely monitoring the situation. We have not identified any evidence of active exploitation of this vulnerability on UpCloud systems.

Affected products

This vulnerability affects Cloud Server, Private Cloud and GPU Server products.

Mitigating actions

We have successfully identified the necessary mitigation for this vulnerability and are actively deploying these updates across our platform and infrastructure. While our response carries a slight potential for workload disruption, we do not expect any visible impact for the vast majority of our customers. No direct action is required from customers at this stage. 

GPU Servers: Due to their architecture, GPU servers cannot be live-migrated. These servers must be shut down and restarted to apply the upgrade, which will result in a longer downtime of approximately 30 to 60 minutes. We will communicate the relevant details directly to affected GPU customers. 

Private Clouds: We will communicate the relevant details directly to affected Private Cloud customers.

If you have questions or concerns, please contact our Support team.