Linux KVM guest-host escape rated critical, may represent a new way to attack penguin-powered networking

CVE-2026-99999 'PwnEscape' is a 9.3-critical Linux KVM guest-to-host escape triggerable via malformed IPv4 packets, with upstream fix now reaching distros.

Researcher Paulos Yibelo disclosed CVE-2026-99999, dubbed PwnEscape, a 9.3-rated Linux KVM guest-host escape flaw that can be triggered with malformed IPv4 checksum metadata, potentially enabling arbitrary code execution on the host, denial of service, or information disclosure. The bug arises because guest-controlled checksum metadata can rewrite security-sensitive packet fields after kernel validation, breaking guest-host isolation. AWS says EC2 is not at risk and Google Cloud is likely unaffected, but KVM-based products like Nutanix and Proxmox are exposed. An upstream Linux kernel fix is propagating to Debian, RHEL, and Ubuntu.

• CVE-2026-99999 rated 9.3 critical; guest-host escape via malformed IPv4 packets
• Impact: host code execution, DoS, or sensitive memory disclosure
• Caused by untrusted checksum metadata rewriting validated packet fields
• AWS says EC2 not at risk; fix rolling out to Debian, RHEL, Ubuntu
• Seventh KVM escape bug found this year, per Edera