# Effect of Linux Kernel CVE-2026-99999 (CVSS 9.3, PwnScape) on the Bitcoin network
**URL:** https://bnoc.xyz/t/effect-of-linux-kernel-cve-2026-99999-cvss-9-3-pwnscape-on-the-bitcoin-network/189
**Category:** Observations
**Tags:** p2p
**Created:** [October 19, 2026, 6:40pm UTC](https://bnoc.xyz/t/effect-of-linux-kernel-cve-2026-99999-cvss-9-3-pwnscape-on-the-bitcoin-network/189 "2026-10-19T18:40:39Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@b10c](https://bnoc.xyz/u/b10c)
#### Post date: [October 19, 2026, 6:40pm UTC](https://bnoc.xyz/t/effect-of-linux-kernel-cve-2026-99999-cvss-9-3-pwnscape-on-the-bitcoin-network/189/1 "2026-10-19T18:40:39Z")
VPS providers have been patching and restarting the hosts of their VPS / cloud servers following [CVE-2026-99999](https://nvd.nist.gov/vuln/detail/cve-2026-99999) for the past days since the vulnerability was made public on the 15th. Some of these likely run Bitcoin nodes. It would be interesting to see the effect of this on the network.
## Timeline
(all times UTC, researched with an LLM)
### Before disclosure
- **08-18** – Vercel opens its $1M Sandbox challenge. The researcher reports a host memory leak to Vercel within days ([TuxCare](https://tuxcare.com/blog/pwnescape-kvm-guest-escape/)).
- **09-04** – Root cause reported privately to the kernel security contact and networking maintainers ([TuxCare](https://tuxcare.com/blog/pwnescape-kvm-guest-escape/)).
- **10-08** – Fix accepted into the networking tree ([6785011f8b16](https://github.com/torvalds/linux/commit/6785011f8b16abf40b1e9d8b2e332232b3e68822)).
- **10-14** – Fix merged into the main Linux tree. Vercel publishes its [challenge findings](https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge).
### Disclosure and provider response
- **10-15 12:19** – CVE published by the kernel CVE team, CVSS 9.3 ([cve.org](https://www.cve.org/CVERecord?id=CVE-2026-99999)). [pwn.ai write-up](https://pwn.ai/blog/pwnescape) and fixed stable kernels the same day.
- **10-15 17:27** – **Akamai (Linode)**: applying mitigations, customer workloads may be affected ([status](https://status.linode.com/incidents/zp71823t318w)).
- **10-15 17:30** – **AWS** : EC2, Lambda and Fargate not affected, no customer action needed ([2026-137-AWS](https://aws.amazon.com/security/security-bulletins/2026-137-aws/)).
- **10-15 17:33** – **Contabo** : patching all VPS/VDS hosts, customers should expect restarts ([status](https://contabo-status.com/)).
- **10-16 08:53** – **Akamai** : patching in phases, no exploitation seen.
- **10-16 21:38** – **netcup** announces VPS/root server reboots from 10-17, block by block, about 20–30 min downtime each ([status](https://www.netcup-status.de/2026/10/vps-root-server-neustarts-ab-dem-17-10-2026/), linked in the [forum](https://forum.netcup.de/thread/23162-pwnescape/)).
- **10-17 05:07** – **Akamai** : all compute hypervisors patched, no exploitation seen.
- **10-17 ~12:03** – First netcup reboot emails reported, sent shortly before the restarts ([forum](https://forum.netcup.de/thread/23162-pwnescape/)).
- **by 10-17** – Debian lists fixed kernels for bookworm and trixie ([tracker](https://security-tracker.debian.org/tracker/CVE-2026-99999)). Ubuntu was still evaluating as of 10-18 ([tracker](https://ubuntu.com/security/CVE-2026-99999)).
- **10-19 12:24** – **netcup** update: names PwnEscape as the reason and apologizes for the short notice. Reboot emails now go out about 1 h ahead.
- **10-19** – **Hetzner** tells [heise](https://heise.de/news/PwnEscape-Kritische-Luecke-in-Linux-Kernel-erlaubt-VM-Ausbruch-11492131.html) it put an eBPF-based mitigation in place shortly after disclosure and does not need to restart its hypervisors right away. Nothing about the CVE on [status.hetzner.com](https://status.hetzner.com/).
- **As of 10-19** – No public statement found from **OVHcloud** , **DigitalOcean** or **Google Cloud**.
Hetzner also did urgent work on 10-15 that does not mention the CVE: [all core routers](https://status.hetzner.com/incident/cd31dd45-f431-4639-8f9a-d4bfb5353f30) from 10:00, and [~500 load balancers in NBG1](https://status.hetzner.com/incident/bc041fc5-3f92-4467-911f-b878f58b5ed3) from 10:30 to 10-16 07:51.
---
### Author:  [@b10c](https://bnoc.xyz/u/b10c)
#### Post date: [October 19, 2026, 6:50pm UTC](https://bnoc.xyz/t/effect-of-linux-kernel-cve-2026-99999-cvss-9-3-pwnscape-on-the-bitcoin-network/189/2 "2026-10-19T18:50:09Z")
[KIT DSN](https://www.dsn.kastel.kit.edu/bitcoin/) covers Churn and Distribution of Connection Durations:
There seems to be a lot more churn since the 16th across all three monitoring nodes.
Additionally, connection durations have dropped slightly since the 16th.
IIRC, KIT runs their nodes on dedicated machines and not cloud machines that might have been affected by this. @matthias, can you confirm?
---
### Author:  [@b10c](https://bnoc.xyz/u/b10c)
#### Post date: [October 19, 2026, 8:23pm UTC](https://bnoc.xyz/t/effect-of-linux-kernel-cve-2026-99999-cvss-9-3-pwnscape-on-the-bitcoin-network/189/3 "2026-10-19T20:23:14Z")
Both Contabo and netcup restarted their VPS hosts after CVE-2026-99999, which shows up in the [KIT DSN snapshots](https://www.dsn.kastel.kit.edu/bitcoin/snapshots/) (peers connected to KIT’s monitors, grouped by AS, compared day to day) and in the [bitnod.es explorer](https://bitnod.es/node_explorer.php).
[Contabo](https://contabo-status.com/) announced on 2026-10-15 at 17:33 UTC that it was patching all VPS hosts and customers should expect restarts. In the KIT data, 17% of Contabo peers (33 of 199) dropped out in the 24 h before the 2026-10-18 snapshot, against 2.5–4.7% per day before. The number of Contabo peers fell from 199 to 170. Few of the rest reconnected, so most of the missing nodes went down and stayed down. bitnod.es shows [40 Contabo nodes](https://bitnod.es/node_explorer.php?isp=Contabo+GmbH&export_date=2026-10-18&sort=export_date&dir=desc&p=1) that were last seen on 2026-10-18 and haven’t come back, against 1–2 per day before, with 149 still up.
[netcup](https://www.netcup-status.de/2026/10/vps-root-server-neustarts-ab-dem-17-10-2026/) restarted its hosts block by block from 2026-10-17, about 20–30 min each, with emails sent shortly before. In the KIT data, 14% of netcup peers dropped out in the day before the 2026-10-17 snapshot and 27% in the day before the 2026-10-18 one, against 0–1.5% per day before. 11% and 26% reconnected, against 3–6% before. The number of netcup peers fell from 66 to 50. On bitnod.es, 5 netcup nodes were last seen on 2026-10-17 and 5 on 2026-10-18, against 0–1 per day before. The 2026-10-18 KIT snapshot (12:38 UTC) is the latest I used, so netcup’s later restart blocks aren’t covered yet.
On both providers, some nodes came back after the restart and some didn’t, possibly because bitcoind isn’t set to start on boot.
---
### Author:  [@matthias](https://bnoc.xyz/u/matthias)
#### Post date: [October 19, 2026, 8:30pm UTC](https://bnoc.xyz/t/effect-of-linux-kernel-cve-2026-99999-cvss-9-3-pwnscape-on-the-bitcoin-network/189/4 "2026-10-19T20:30:11Z")
> KIT runs their nodes on dedicated machines and not cloud machines that might have been affected by this. @matthias, can you confirm?
Yes, I can confirm. We haven’t restarted our nodes.
Thanks for your analysis of the snapshots. That’s very interesting!
I think, however, that the churn that we see in the total amount of connections is probably unrelated to this event. We have already seen a similar amount of churn during the last months:
