(PwnEscape) Guest-to-Host KVM Escape [CVE-2026-99999]

We have completed our investigation and response to the “PwnEscape” Guest-to-Host Escape vulnerability (CVE-2026-99999). We have published a documentation article with detailed guidance on available mitigations and recommended actions for affected systems: https://www.akamai.com/cloud/guides/cve-2026-99999-pwnescape-mitigation/ We encourage all customers to review the article and apply the appropriate mitigations to their environments. If you have questions or need assistance, please open a Support ticket, or contact us at 855-454-6633 (+1-609-380-7100 Intl.) / support@linode.com.

Akamai has completed patching Compute hypervisors for the known vulnerabilities related to CVE-2026-99999, also referred to as “PwnEscape”, and we have not identified any exploitation on the Akamai platform. We recommend that customers upgrade Linode guest VMs using kernels from upstream OS vendors as those become available, especially for cases where less trusted workloads are being run within containers or nested virtualization. We are in the process of preparing images containing fixes from upstream vendors.

We have not identified any exploitation on the Akamai platform so far. As of now, our subject matter experts are continuing to work on patching server sets in phases across the Akamai platform. We are actively monitoring our platform while we perform the mitigation actions.

Akamai is aware of the recently published Guest-to-Host KVM Escape (CVE-2026-99999) vulnerability. Our teams have proactively identified its potential impact and are actively applying mitigations across our platform and infrastructure. There is potential for customer workload impact as a part of our platform response to this vulnerability. At this time, we have not observed evidence of this vulnerability being actively exploited on our platform. We will provide updates as additional information becomes available.