PwnEscape (CVE-2026-99999): the Linux kernel flaw that lets a VM escape its KVM host

Why CVE-2026-99999 matters to anyone running VMs on Linux

On 15 October 2026, the Linux kernel CVE team published CVE-2026-99999, scored 9.3 out of 10 on CVSS 3.1. The same day, seven patched stable kernels shipped, and the pwn.ai research team released its write-up under the name PwnEscape. The summary is the kind that makes anyone running a hypervisor sit up: a guest virtual machine can, by sending crafted network packets, read the host kernel's memory, crash it, and, under lab conditions, run code as root on it.

"VM escape" is one of those phrases you read in conference talks and rarely meet on your own infrastructure. Here the setting is as ordinary as it gets: a Linux host, KVM, a virtio-net card. No exotic hypervisor, no niche driver. The code involved dates back to 2008 (Linux 2.6.27) and lives in every kernel we run today, from the 4.x of enterprise distributions to the freshest 7.x. Eighteen years, then, during which any hosting provider, private cloud or sandbox platform could have been running untrusted guests on top of this path.

Let's state right away what the flaw is not: it is not remotely exploitable. You have to be inside a guest, or more rarely an unprivileged local user on the host, to trigger it. The threat model is the hostile tenant: a customer renting a VM from you, a CI pipeline running third-party code, an AI agent boxed into a micro-VM so it can work. Which is exactly the use case we picked virtualization as a security boundary for.

This article takes the mechanism apart, draws the line between what is demonstrated and what is not, lays out the state of the fixes distribution by distribution, and details the remediation plan, stopgaps included.

The facts, as the primary sources state them

Two notes on this table. First the disagreement over the score: the CNA holds that no privilege is required (PR:N), while Red Hat and SUSE judge that one is (PR:L), namely the ability to send packets from the guest. The gap changes nothing in the decision: either way the vector is local, the scope goes beyond the component (S:C, you leave the VM) and all three impacts are at maximum. Second, Red Hat's advisory mentions an internal "KEV" tracking of the flaw; we re-read CISA's catalog on 19 October and it is not there. So as of this date we treat it as a critical but not publicly exploited vulnerability, which is precisely the window where fixing costs the least.

Inside the bug: two parts of the kernel that don't read the same packet

To understand PwnEscape you have to accept a slightly counter-intuitive idea: the problem is not in KVM, nor in virtio, nor in IP fragmentation taken on its own. It is in the fact that these pieces do not look at the same version of the packet. The researchers call it a "deferred-metadata trust inversion." Here is the idea, at the level the public sources describe it.

When a VM emits a packet through a virtio-net card, it attaches a small header of offload hints. One of them says, in effect: "I haven't computed the checksum, do it for me, it starts here and the result goes there." That is a perfectly legitimate optimization, used everywhere. The host accepts those hints, marks the packet as pending, and defers the computation.

The input check did exist, but it was too loose: it located the start of the checksum relative to the start of the buffer, without accounting for the link-layer header in front of it, and without checking that this point falls after the IPv4 header. That is the whole flaw: a value the guest controls, insufficiently bounded, pointing to a spot inside a header the rest of the stack considers safe and already validated.

The packet then travels through the host's entire IPv4 stack, which reads a normal-sized header and trusts it for routing and filtering rules. It is only at fragmentation time, on the way out, that the deferred computation runs and writes at the spot the guest designated, inside the header. The field that announces the header length changes value. The host then copies, into each fragment, far more bytes than there is actual data, and those extra bytes are host kernel memory, returned to the guest in the guise of IP options.

That is the heart of PwnEscape, and it is enough to grasp the scope without turning it into a tutorial. The rest, going from that leak to a controlled write and then to code execution, relies on heap-grooming techniques the researchers have deliberately kept private for a second write-up. We do the same: there is no ready-to-run payload in this article.

From the leak to host control: what is proven, what is not

As with any high-profile flaw, the real severity turns on telling apart what is demonstrated from what stays conditional. PwnEscape reads on three steps, each harder than the last.

This ranking is not a communication detail, it drives the response. The leak is the established and most immediate fact: Vercel confirms it observed it against its own production sandboxes, though its analysis found no customer data, secret or file exposed. The crash is a serious availability threat to a shared host. Code execution remains, to this day, a lab demonstration. The researcher does warn, however, that he expects exploits against weak configurations "within weeks" and against default configurations "within a month." That is a forecast, not a finding, but it sets the horizon for remediation.

Am I affected? The scope, without jargon

The right question is not "which kernel version", it is "do untrusted guests share my host". Three cases.

• You host VMs you don't control (VPS customers, sandboxes, ephemeral CI runners, AI agents in micro-VMs): you are on the front line. The virtio-net path via TAP or vhost-net is the main vector, and it is on by default.
• You run a hostile local user on a shared machine: local paths exist, through the unprivileged user namespaces that let one open certain network devices. They are judged "plausible from the code" but not all confirmed. On Red Hat-derived distributions 8 and later, those namespaces are enabled by default.
• You run only your own workloads, with no nested virtualization and no third-party tenant: your exposure is marginal. A packet from the network cannot, on its own, forge this metadata. Patch anyway, in the normal cycle.

A word on the public cloud, because the question comes up at once. AWS published bulletin 2026-137 on 15 October 2026: managed services (EC2, Lambda, Fargate) are not affected, no action is required for them. The case in scope is the customer who self-manages VMs with KVM and virtio-net, for example with nested virtualization on an instance, on a bare-metal instance, or behind a manager such as Firecracker. AWS is clear on one point: "there are no workarounds", the only way out is the patched kernel. On the hosting side, Japan's Sakura Internet even suspended new sign-ups for several plans on 16 October while it verified its hypervisors' isolation, keeping existing servers running.

Checking your exposure without breaking anything

Unlike an application flaw, you do not "test" PwnEscape by sending a payload: reproducing it already risks bringing the host down. Verification is therefore by configuration check, not by exploitation. Three steps, to run on the virtualization host.

1. Read the running kernel version

uname -r

2. See whether checksum offload is active on your guests

This is the setting that opens the main vector. Under libvirt, for a given domain:

virsh dumpxml <domain> | grep "csum="

Empty output means QEMU's defaults apply, and offload is active. That is the common state.

3. For shared hosts, check the local path

If unprivileged users share the host, measure whether they can create an isolated network namespace, a prerequisite of the local paths:

sysctl user.max_user_namespaces
unshare -Urn echo ok   # run as an unprivileged user: if it fails, that path is closed

What to do now: the remediation plan

In order of effectiveness, the only complete remediation being the patched kernel.

1. Apply your distribution's patched kernel, then reboot the host. That is the fix, everything else only buys time. On a virtualization host, migrate or cleanly stop the guests before the reboot, which interrupts them all.
2. While waiting for the reboot, disable checksum offload on untrusted guests. This is the mitigation TuxCare and CloudLinux recommend. Under libvirt, add inside the domain's <interface> element:

   <driver>
     <host csum='off'/>
     <guest csum='off'/>
   </driver>

   Set it per VM, with a guest restart. Downside: the guest loses TSO and GSO, so throughput. And it is an untested mitigation against this precise flaw: it closes the most obvious vector, not necessarily all of them.
3. On a shared host without VMs, reduce the local paths by disabling unprivileged user namespaces (sysctl -w user.max_user_namespaces=0), knowing it breaks rootless containers and the Chrome and Flatpak sandboxes. Reserve it for hosts where that trade-off is acceptable.
4. If you buy livepatching (KernelCare and the like), track the availability of a rebootless patch: it was rolling out for the Red Hat 9 family in mid-October.

Monitoring, while you patch

There is no indicator of compromise specific to this flaw, and no ready-made detection rule: CISA published none. Monitoring is therefore behavioral. On your virtualization hosts, correlate three signals: kernel panics that coincide with a guest's network activity, abnormal IPv4 fragmentation events, and unusual behavior from the virtualization processes right after guest traffic. If you suspect an escape, treat the whole host as compromised, preserve its memory and network traces, and examine the neighboring workloads: a successful escape exposes every tenant on the same host.

The state of the fixes, distribution by distribution

As of 16 October 2026, the picture was mixed. Always check your distribution's official advisory before acting, this snapshot ages fast.

• Upstream kernel: fixed in 7.3-rc7, and in stable 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11.
• Debian: fixed in bookworm as 6.1.190-1 (DLA-4841-1) and in trixie as 6.12.113-1 (DSA-6568-1).
• AlmaLinux: fixed kernels available in the almalinux-testing repository (8, 9 and 10), while they move to production.
• Red Hat family (RHEL, Rocky, Oracle Linux): marked affected, delegated resolution in progress, no fixed kernel released by mid-October.
• SUSE / openSUSE: marked affected, security advisories pending.
• Ubuntu: the page exists, no package showed a fixed version yet, each kernel "needs evaluation".
• Amazon Linux: fix to pull via AWS's update guides for self-managed KVM hosts.

The lesson: the virtualization boundary is not a black box

PwnEscape is not an exploitation feat, it is a trust mistake. Two parts of the kernel read the same string of bytes and drew different conclusions, one trusting a piece of metadata the other let the guest control. The fix is about forty lines long and its own author calls it "defense in depth": a patch placed at the right spot, pending fuller validation at the input. Which is to say the surface is not entirely closed.

The real lesson is elsewhere. We choose virtualization precisely to isolate what we don't trust: a customer, third-party code, an automated agent. For eighteen years that boundary held a crack no one had looked at, until a well-funded challenge pointed modern tools at it and found it in three days. What holds for the kernel holds for your whole perimeter: a protection you never test ends up tested by someone else. And a flaw like this one shows up neither in an application scan nor in an annual pentest dated last spring. It shows up when you map your whole information system and inventory your external attack surface, virtualization hosts and admin interfaces included, then monitor their version and configuration continuously. The lesson echoes the one from the Proxmox VE 7 authentication bypass: the management plane of a virtualization estate has no business facing the Internet.

Detecting this kind of exposure continuously with Flawfence

At Flawfence, the principle does not change from one flaw to the next. The engine maps your Internet-facing perimeter, identifies the services answering in your name, places their versions in the known vulnerable ranges and checks the exposure of the relevant vectors, without ever sending a destructive payload.

A kernel flaw like PwnEscape does not trigger from the Internet, and we won't pretend to test it remotely: that would be dishonest. What Flawfence brings is the other half of the problem, the half that gets neglected. Are your hypervisor admin interfaces (Proxmox, oVirt, cloud consoles) reachable from outside? Do your hosts expose services whose version betrays an old kernel never rebooted? Does a new subdomain, a forgotten console, a host reappearing after a migration raise an alert, or does it slip under the radar until the next audit? That is where the response to a flaw like this is won or lost.

Frequently asked questions about PwnEscape (CVE-2026-99999)

What is PwnEscape, in one sentence?

A critical flaw in the Linux kernel's IPv4 stack (CVE-2026-99999, CVSS 9.3) that lets a guest virtual machine read its KVM host's kernel memory, crash it, and, in a lab, run code as root on it. It lives in the networking the host shares with its guests, not in KVM itself.

Am I vulnerable if I don't host anyone else's VMs?

Your exposure is low. The flaw triggers from an untrusted guest, or from a hostile local user on a shared machine. If you run only your own workloads, with no third-party tenant and no nested virtualization, the risk is marginal. Apply the patched kernel anyway, in your normal cycle.

Is it exploitable remotely from the Internet?

No. The metadata involved is internal network-buffer information, which a card does not build from a received packet. You have to be inside a guest or be a local user to produce it. That is why the CVSS vector is local (AV:L), despite the maximum severity of the impacts.

Is my cloud provider affected?

For managed services, no. AWS confirmed on 15 October 2026 that EC2, Lambda and Fargate are not affected. The case in scope is the customer who self-manages VMs with KVM and virtio-net, including behind Firecracker. If that is you, patching the host kernel is on you.

Is the flaw being exploited in the wild?

Not to our knowledge as of 19 October 2026. There is no public exploit code, no observed exploitation has been reported, and the flaw is not in CISA's KEV catalog. The memory leak was demonstrated in production against Vercel, but root code execution was only reproduced in a lab. The researcher does expect exploits to appear within weeks, though: the window to patch quietly is short.

Is a kernel reboot enough?

Yes, provided you first installed your distribution's patched kernel. A fixed kernel that is present but not booted does not protect: afterwards, check that uname -r and the package revision match the fixed version your distribution announced. Livepatches (KernelCare-style) fix without a reboot when they are available for your kernel.

Is disabling checksum offload a real protection?

It is a stopgap, not a fix. It closes the most obvious vector, at the cost of reduced network throughput for the affected guests, and it has not been tested exhaustively against this precise flaw. You apply it while waiting to reboot onto the patched kernel, not instead of it.

In short

CVE-2026-99999 is a reminder that the virtualization boundary, the one all shared hosting and all untrusted code execution rests on, is only safe as long as you verify it. A poorly bounded piece of metadata, present since 2008, was enough to crack it. The good news is that the fix exists, that no public exploitation has been observed yet, and that a simple stopgap closes the main vector while you schedule a reboot.

The underlying reflex stays the same as for every flaw we cover: an exhaustive inventory of what your organization exposes, and continuous monitoring of the version and configuration of those assets. That is what Flawfence does, for hypervisor admin interfaces as for the next flaw that doesn't have a number yet.

Check your exposure right now, it will take you five minutes.

Sources

• pwn.ai, "PwnEscape" (the finders' primary write-up)
• oss-security, 15 October 2026 announcement
• Kernel commit 6785011f8b16 "ipv4: validate checksum_start before completing checksum"
• Vercel, "Findings from the $1M Vercel Sandbox challenge"
• Red Hat, CVE-2026-99999 advisory
• AlmaLinux, "PwnEscape (CVE-2026-99999): Patched kernels available in testing"
• TuxCare, "PwnEscape Hid in the Kernel Network Stack for 18 Years"
• CloudLinux, "CVE-2026-99999 Guest-to-Host Escape"
• The Hacker News, "Critical PwnEscape Linux Kernel Vulnerability"
• Debian Security Tracker, CVE-2026-99999
• Ubuntu Security, CVE-2026-99999
• SUSE, CVE-2026-99999