CVE-2026-99999 VM Escape Flaw: Why You Must Backup VPS Data Immediately

A security firm disclosed a new Linux kernel vulnerability named PwnEscape tracked as CVE-2026-99999 . The flaw resides in the Linux kernel IPv4 network processing code where insufficient validation of metadata allows previously verified network headers to be rewritten during subsequent operations.

Technical Details

An attacker must first achieve code execution inside a virtual machine on the affected host, then send specially crafted network packets. According to advisories from Red Hat and Amazon, successful exploitation can lead to host memory leaks, denial of service, and arbitrary code execution on the hypervisor — effectively breaking VM isolation.

The vulnerability was discovered by security researcher Paul Yibelo during the Vercel Sandbox challenge. The research team reported they have already demonstrated a full VM escape to the host in their own KVM test environment, underscoring the high risk for any enterprise using virtualization.

Provider Response and Patching Status

The fixed stable Linux kernel was released on October 15 . Because the patch requires loading a new kernel and rebooting the physical host, many VPS providers are rolling out updates in batches:

BandwagonHost — restarting all physical servers; all VMs will be paused.

Hostinger , Contabo , MVPS , FreakHosting — also rebooting hosts after applying patches.

Contabo — waiting for upstream distribution patches before proceeding.

UpCloud — expects minimal impact for most users, but GPU servers require a full shutdown and reboot with an estimated 30–60 minute interruption.

During host reboots, guest VMs go offline temporarily, which explains the brief connectivity losses some users have observed.

Critical User Actions

Backup immediately. The article strongly urges all VPS users to backup their virtual machine data now. Past incidents have shown that some providers delay patching; unpatched hosts remain exploitable, and a successful attack could encrypt all VM data beyond recovery.

Guest kernel updates do not mitigate this vulnerability. The flaw exists at the host level, so updating the kernel inside your own VM provides no protection. If concerned, backup first, then open a support ticket with your VPS provider to confirm their patch deployment timeline.

Source: Landian News (蓝点网), author: 山外的鸭子哥. Original report based on public advisories and provider announcements.

Code example

作者丨
山外的鸭子哥