Major Linux Vulnerability disclosed - CVE-2026-99999 - Cycle OS image is already live. Reboot your servers.

Hey everyone,

One of the most serious Linux kernel vulnerabilities I have seen went public today: CVE-2026-99999, known as PwnEscape. The patched Cycle OS image is already live. Our writeup is included in this blog but before you dig into that; Here’s what you need to know and remember: just reboot your servers and they will pull the patched OS on boot.

What the issue is

PwnEscape is a guest-to-host escape in the kernel’s IPv4 networking stack. A virtual machine can send crafted virtio network data that makes the host corrupt its own packet headers. The researchers used that to leak host memory, crash hosts and, in a lab setup, run code as root on the host.

Full writeup: https://pwn.ai/blog/pwnescape

What you need to do: reboot your servers

That’s it. Every Cycle server pulls the latest OS image over iPXE when it boots, so a reboot is all it takes to get running with the patched kernel.

Tips for rebooting without downtime

• Reboot one at a time. If a cluster has more than one server, restart them one by one and wait for each to come back online before moving to the next.
• Check your instance spread first. Services whose instances all sit on one server will be briefly unavailable while that server reboots. If that’s a problem, scale up or move instances to another server beforehand.
• Do VM hosts first. Servers running virtual machines, especially guests you don’t fully control, are the most exposed to this bug, so start with those.

Questions?

Reply here or reach out to us through slack, and we’ll help you in any way we can.

Thanks,
The Cycle Team