(PwnEscape) Guest-to-Host KVM Escape [CVE-2026-99999]

Event timeline

How this incident unfolded, from the official status page.

1. Identified

   8 days ago

   Linode

   Akamai is aware of the recently published Guest-to-Host KVM Escape (CVE-2026-99999) vulnerability. Our teams have proactively identified its potential impact and are actively applying mitigations across our platform and infrastructure. There is potential for customer workload impact as a part of our platform response to this vulnerability. At this time, we have not observed evidence of this vulnerability being actively exploited on our platform. We will provide updates as additional information becomes available.

2. Identified

   8 days ago

   Linode

   We have not identified any exploitation on the Akamai platform so far. As of now, our subject matter experts are continuing to work on patching server sets in phases across the Akamai platform. We are actively monitoring our platform while we perform the mitigation actions.

3. Identified

   7 days ago

   Linode

   Akamai has completed patching Compute hypervisors for the known vulnerabilities related to CVE-2026-99999, also referred to as “PwnEscape”, and we have not identified any exploitation on the Akamai platform. We recommend that customers upgrade Linode guest VMs using kernels from upstream OS vendors as those become available, especially for cases where less trusted workloads are being run within containers or nested virtualization. We are in the process of preparing images containing fixes from upstream vendors.