PwnEscape: critical Linux kernel flaw enables VM-to-host escape

A critical vulnerability in the Linux kernel networking stack, named PwnEscape and tracked as CVE-2026-99999, lets a guest virtual machine read portions of host memory and, through a longer exploit chain, reach code execution on the host. The Hacker News and CSO Online reported it on 16 October 2026, The Register and heise Security on 19 October. According to The Register, the flaw is rated 9.3.

None of the sources reports exploitation in the wild, but the researcher who found it expects working exploits within a few weeks.

Who found it

According to CSO Online, the flaw was found by Paulos Yibelo of Pwn.ai during the $1 million security challenge launched by Vercel on 18 August for its Vercel Sandbox environment, which invited researchers to break virtual machine isolation. Vercel called it the most severe finding submitted to the programme: the crash and code execution were demonstrated on the researcher’s own KVM and Firecracker machines, configured like Vercel Sandbox, and the company says there is no sign of access to customer data.

How it works

The problem lies in checksum offloading: Linux can defer computing a packet’s checksum to a later stage, and the packet metadata says where the computation starts and where the result is written. If that metadata comes from a guest, a less trusted domain, it can make the write land inside the IPv4 header, which the kernel has already checked and acted on.

According to CSO Online, Yibelo showed that after validation the IPv4 header length can be changed from 20 to 60 bytes: when the fragmentation code reads the header again, it treats data beyond the packet as header and places 32 bytes of adjacent host memory into an outgoing packet. This is a TOCTOU (time-of-check/time-of-use) flaw, but without the usual race between threads: the deferred write happens along the normal packet path. An analysis by SOC Prime quoted by The Register stresses that the leak can be repeated, so a guest can collect host information piece by piece.

Yibelo then used this read primitive, together with other techniques, to obtain targeted kernel memory writes and run a program as root on the host. He reports completing the chain in his lab, on his own systems, across four separate cold boots; the details of this part are not yet public.

According to The Register, Red Hat lists the possible impact as arbitrary code execution on the host, a system crash (denial of service) or disclosure of sensitive memory. In MITRE ATT&CK the scenario maps to T1611, Escape to Host.

Not just KVM

The Register frames the flaw as a KVM guest-host escape, KVM being the hypervisor used by most hyperscale clouds. Yibelo, however, according to CSO Online, stresses that the bug is not specific to KVM or any other hypervisor: it sits in the Linux networking stack that handles guest traffic. The researcher describes a new class of attacks: untrusted checksum metadata rewriting sensitive packet fields after the kernel has already validated them.

Fix and versions

The accepted fix, commit 6785011f8b16, adds checks before the checksum-completion operations so that the write cannot corrupt the IPv4 header. According to CSO Online, it landed in the development tree on 8 October and in the mainline kernel on 14 October; the NVD description of the vulnerability lists fixes in the stable branches 5.10, 5.15, 6.1, 6.6, 6.12, 6.18 and 7.2, plus the mainline fix. The sources do not give the exact fixed version numbers for each branch. Yibelo calls the patch a defence-in-depth measure and warns that validation of untrusted checksum metadata still needs to be extended.

According to The Register, the fix is reaching the major distributions (Debian, RHEL, Ubuntu) and will need to reach KVM-based virtualisation products such as Nutanix and Proxmox. The same outlet reports that AWS says EC2 is not at risk, and that Google Cloud, given the way it uses KVM, is probably not affected either.

Why it matters for European and Italian companies

Many companies run virtual servers on Linux hosts: Proxmox clusters, OpenStack platforms, KVM-based hyperconverged solutions, plus micro-VMs used to isolate containers, CI/CD pipelines and AI agents. Wherever workloads with different trust levels share a host (different customers, test and production, third-party code), a guest escape breaks the very isolation the separation relies on.

For NIS2 entities in digital infrastructure and ICT service management, such as cloud providers, data centres and managed service providers, the update is part of vulnerability management; any significant incident must be assessed for notification to the national CSIRT (in Italy, ACN’s CSIRT Italia). In healthcare, virtualised environments hosting clinical applications should be included.

What to do now

1. Find the affected hosts: Linux hypervisors with KVM, hosts running micro-VMs such as Firecracker, and Linux-based virtualisation appliances.
2. Update the host kernel as soon as your distribution or vendor publishes the fixed package: look for CVE-2026-99999 in their advisories. The new kernel requires a host reboot (or a live patch, if your vendor offers one): plan VM migration accordingly.
3. Prioritise hosts running untrusted or multi-customer code: hosting, multi-tenant platforms, sandboxes, CI runners, labs.
4. Ask your providers of private cloud, hosting and appliances when they will apply the fix.
5. In the meantime, the sources do not mention workarounds: keep less trusted workloads away from your most critical hosts.
6. Monitor the hosts: kernel crashes or networking-related errors, unexpected processes with root privileges, unusual child processes of the hypervisor. No indicators of compromise have been published.

How ARXDOME helps

The ARX Sentry inventory reports the system, software and processes of Linux servers running the agent: it helps you find virtualisation hosts and their kernel versions. ARX Shield shows open vulnerabilities by machine and by package, so you can track the update host by host.

Last updated: 19 October 2026