New Linux kernel vulnerability is extremely harmful, multiple VPS providers are patching it in batches

Abstract:

Last weekend, a security company announced a new kernel vulnerability called PwnEscape. The vulnerability is numbered CVE-2026-99999 (still a pretty name). The vulnerability is located in the network stack and can be isolated across virtual machines. In view of the extremely high degree of harm of the vulnerability, many VPS server providers have successively initiated emergency maintenance to install patches on the host machines and restart the physical servers, so some users will notice that their chicks are temporarily disconnected.

Execution of arbitrary code across virtual machine isolation:

This vulnerability is located in the Linux Kernel IPv4 network processing code. When the kernel processes specific data packets, it does not fully check and verify metadata, which may cause the verified network header to be overwritten by subsequent operations. An attacker needs to run code in a virtual machine on the affected host before sending specially crafted network packets. Security notes from Red Hat and Amazon list that the vulnerability may lead to host memory leaks, denial of service, and arbitrary code execution.

Security researcher Paulos Ibero discovered the vulnerability during the Vercel Sandbox Challenge. The research team said it had demonstrated escape from the virtual machine to the host in its own KVM test environment. This vulnerability poses a very high risk to enterprises using virtualization, so it is very important to install updates in a timely manner.

Multiple VPS service providers restarted their servers in batches:

The stable version of the Linux Kernel used to fix this vulnerability was released on October 15. Since the host must load a new kernel and restart, many VPS server providers choose to install patches in batches and restart the host to seal the vulnerability.

Currently, BandwagonHost, Hostinger, Contabo, MVPS, FreakHosting, etc. have successively restarted the host to fix the vulnerability. Since the virtual machine running on the host will be temporarily offline when the host is restarted, users will find that their servers are temporarily disconnected.

For example, Bricklayer said that it will restart all physical servers, so all virtual machines will be suspended; Contabo uses batch updates and waits for the patches of the distributions it uses to be in place; UpCloud said that most users are not expected to be significantly affected, but the GPU server needs to be shut down and restarted, and the expected interruption time is 30 to 60 minutes.

In view of the shady behavior of some VPS providers

In addition, the impact of this vulnerability is at the host level. Users updating their own virtual machine kernel cannot solve the problem. If users are worried, it is best to back up all data first, and then send a work order to the VPS server provider to consult the patch installation plan.