The Linux kernel vulnerability CVE-2026-99999 (PwnEscape) was disclosed, and cloud providers are taking measures such as temporarily suspending new applications because of the risk of impact on virtualization hosts. Instantaneous, non-disruptive patching and continued use of EOL environments are issues under consideration.
The serious Linux kernel vulnerability CVE-2026-99999, known as PwnEscape, disclosed on 21 October 2026, is an out-of-bounds memory-write vulnerability involving network processing in virtualization platforms. Attacks may spread to the host, beyond affecting guest operating systems. The CVSS score is high, and risks cited include virtual machine takeover, leakage of host memory information and service outages.
In response to the vulnerability, major cloud providers in Japan took measures including suspending acceptance of new environments. Sakura Internet announced on 16 October 2026 that it would suspend new applications and its scale-up function for impact assessment and remediation. A major factor is the threat posed to the isolation structure of multitenant environments.
Operational challenges include the impact of kernel updates requiring an OS reboot and the uncertainty of receiving remediation patches when continuing to use operating systems that have reached end of life (EOL). Rebooting virtual hosts running multiple VMs and securing maintenance windows could significantly increase operating costs.
As countermeasures, Cybertrust Japan Co.,Ltd. provides a Linux live patching service that fixes the kernel without rebooting the OS, as well as extended support for EOL environments, including CentOS Extended Support LITE and AlmaLinux ESU. These services offer a way to mitigate vulnerabilities without stopping servers in operation.