CVE-2026-99999, a critical vulnerability in the Linux kernel, was publicly disclosed on 15 October 2026. We have been tracking it within our systems since publication.

Essential information

• The vulnerability is rated Critical (CVSS 9.3).
• It affects the Linux kernel on all VPS and VDS host systems. In virtualized environments, it could allow a workload on a host to interfere with the underlying host and the isolation between customers.
• Contabo will deploy patches gradually, as they become available for our distributions.

What this means for customers

Patching requires a reboot of each host. Because all hosts are affected, customers should expect  VPS or VDS to be restarted at some point during the patching period. We will do our best to keep interruptions as brief as possible. Given the urgency and the number of hosts involved, we cannot send individual advance notice for each one.

Why we are acting now

We know that unplanned downtime is disruptive, and we do not take it lightly. However, leaving a critical vulnerability open would put services and data at far greater risk than a short reboot. Protecting our customers comes first, and applying this patch quickly is the most effective way to do that.

What customers can do

• Make sure to have recent backups of important data.

• Make sure that applications and services are set to start automatically after a reboot, and check them once the server is back online.

Progress updates will be published on contabo-status.com when necessary.