PwnEscape Linux Kernel Flaw CVE-2026-99999 Lets VM Guests Escape to the Host
Do Son 
TL;DR
PWNAI Research has disclosed PwnEscape (CVE-2026-99999), a critical Linux kernel VM escape flaw in the IPv4 networking stack. In lab tests, a guest VM leaked host memory and then ran code as root on the host. Fixed stable kernels are out, and admins of virtualization hosts should update now.
- CVE: CVE-2026-99999
- CVSS: 9.3 (Critical · CVSSv3)
- Product: Linux
- Affected: f43798c27684ab925adde7d8acc34c78c6e50df8, 2.6.27
- Impact: ipv4: validate checksum_start before completing checksum
- Status: No confirmed exploitation yet
- Patched in: a464d950f31c89565cbaae038cc60db04fe01956, 0fab003ef4698e0628060a45a48f14b43ba2a40a, 94524b7b32691de2e2ce162c04d6cbc9106e5cbf, a65f69e0f38ffbed1b128029e09097436416dc8b (+12 more)
- EPSS: 0.2% (30-day)
- Action: Update to a464d950f31c89565cbaae038cc60db04fe01956, 0fab003ef4698e0628060a45a48f14b43ba2a40a, 94524b7b32691de2e2ce162c04d6cbc9106e5cbf, a65f69e0f38ffbed1b128029e09097436416dc8b (+12 more) now
Why It Matters
Virtual machines are the main wall between cloud tenants. PwnEscape breaks that wall without touching the hypervisor itself. As the researchers put it, “the vulnerability wasn’t even in the hypervisor, it was in the Linux networking stack.”
Researcher Paulos Yibelo found the flaw during Vercel’s $1 million Sandbox challenge, which launched on August 18, 2026. According to the write-up, the team found the core primitive “within three days.” Vercel later called it the program’s most important report.
The bug has a long reach. The official CVE record shows it affects kernels as far back as 2.6.27. Both Red Hat and the kernel CVE team rate it critical.
AI-assisted discovery
PWNAI says humans led the work while an AI model handled much of the source-level analysis. The team claims it searched the code “for under 700$ of API tokens.”
How the Attack Works
Linux can delay checksum calculation and finish it later. To do so, it relies on metadata that says where to write the result. In a VM, the guest can influence that metadata.
PWNAI found that this delayed write could land inside an IPv4 header the kernel had already checked. As a result, later code trusted a changed header. In the researchers’ words, “different parts of Linux were allowed to trust different versions of the same packet.”
From leak to host takeover
At first, the bug leaked 32 bytes of host memory per packet into outgoing traffic. The team then used that leak to plan controlled writes into host kernel memory. In its own KVM lab, the chain ran a root helper on the host across four separate cold boots.
The researchers stress the limits of that claim. It is “not a claim of root command execution in any vendor’s production environment.” Still, Vercel told CSO Online it saw no sign that anyone accessed customer data in its sandbox.
Exploitation status
PWNAI has published full technical details of the Linux kernel VM escape. However, it has not released exploit code, and it is holding back the host-takeover steps for a later post. No exploitation in the wild has been confirmed.
That window may be short. Yibelo expects exploits for weaker setups “to arrive in weeks” and for default hypervisor settings “in under a month.”
Affected Versions
The flaw affects Linux kernels from 2.6.27 onward. It is not tied to one hypervisor, and local attackers can also reach the bug without a VM. The kernel CVE record lists these fixed stable releases:
- 5.10.272, 5.15.223 and 6.1.190
- 6.6.159, 6.12.113 and 6.18.57
- 7.2.11
AlmaLinux says versions 8, 9 and 10 are affected. Red Hat lists RHEL 8, 9 and 10 as affected, with no fix released at the time of AlmaLinux’s post.
Patch and Mitigation Steps
- Update to a fixed stable kernel, or a vendor kernel with commit 6785011f8b16.
- AlmaLinux users can test patched kernels from the almalinux-testing repository now.
- Migrate or shut down guests before rebooting virtualization hosts.
- Prioritize multi-tenant hosts, sandbox platforms and CI runners that run untrusted code.
No workaround exists. Moreover, the upstream patch is a defense-in-depth fix, and fuller input validation is still in progress. For the full technical story, read the PwnEscape research write-up from PWNAI. Given its critical rating, this Linux kernel VM escape belongs at the top of every cloud team’s patch list.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
