Emergency node reboot: kernel vulnerability PwnEscape patched

On 17 October, from 14:07 to 14:28 UTC, we rebooted all hosting nodes one by one — two in the Netherlands and one in Germany. Virtual machines were shut down gracefully and started right after their node came back, so each was unavailable for about five to six minutes. We could not warn you in advance, and we apologise for that.

What happened

A critical vulnerability was found in the Linux kernel network stack — PwnEscape, CVE-2026-99999, rated 9.3 out of 10 on the CVSS scale. From inside a virtual machine it allowed reading the physical node’s memory, crashing the node together with all neighbouring machines, or running code on the node itself. The bug is not in the hypervisor or the control panel but in the kernel: it sat in the code for about eighteen years and affects all current versions.

Why right away and not at night

There is no workaround: only a new kernel closes the hole, and it takes effect after a reboot. AlmaLinux released a fixed kernel on the evening of 16 October; we installed it and rebooted the nodes the next day. Waiting for a night-time window would have left every server exposed for another day.

Now

All nodes run the fixed kernel, and all virtual machines are up again.

If your server did not come up or behaves oddly, contact support — we will look into it first.

Under the SLA, work without prior notice counts as downtime. Five to six minutes fit within the promised 99.8% monthly availability; if, together with other outages, your server’s availability for October ends up lower, you will receive a credit.

More about the vulnerability: the AlmaLinux advisory, the researchers’ write-up and the Red Hat page.