In October 2026, researchers disclosed PwnEscape (CVE-2026-99999): an 18-year-old flaw in the Linux kernel's IPv4 networking code that lets code inside a virtual machine leak host memory, crash the host and, in lab conditions, run code as root on the host. Fixed kernels are out for most distributions. Here is who is affected, the fix status as of 21 October 2026, and exactly what to do.
Quick answer
PwnEscape (CVE-2026-99999) is a Linux kernel bug in how the host validates checksum metadata on network packets coming from a virtual machine. A malicious guest can use it to read host kernel memory, crash the host and, in the researcher's lab, escape to the host as root. The fix is a patched host kernel plus a reboot — updating the guest does not fix the host, and there is no configuration workaround. Virtualization hosts that run VMs for other people should patch first.
What is PwnEscape (CVE-2026-99999)?
When a VM sends traffic through a virtio network device with checksum offload, it tells the host where in the packet the checksum should be written. The host kernel did not check that this location stays outside the IPv4 header. A guest could point it into the header, so the host's checksum code overwrote a header it had already validated — in the researcher's example, turning a 20-byte header into a 60-byte one. That mismatch is the primitive behind everything else.
The researcher, Paulos Yibelo of pwn.ai, found it during Vercel's sandbox security challenge and reported it privately on 4 September 2026. The fix — "ipv4: validate checksum_start before completing checksum" (upstream commit 6785011f8b16) — was merged into the mainline kernel on 14 October 2026, and fixed stable kernels followed the next day. The faulty code dates back to Linux 2.6.27 in 2008, so practically every kernel in use is affected.
What an attacker can do
- Leak host memory — each crafted packet can carry back around 32 bytes of host kernel memory, for as long as the guest keeps sending packets. Vercel confirmed this against its production sandboxes.
- Crash the host — two crafted packets were enough to take down the host and every VM on it (shown on the researcher's own machines).
- Run code as root on the host — demonstrated only on the researcher's lab KVM and Firecracker machines, not in any vendor's production environment. Details are being held back for a later write-up.
The attacker must already run code inside a guest (or locally on the machine). It is not something an outsider can trigger by sending packets across the internet. No exploitation in the wild has been reported so far.
How severe is it?
The kernel CVE record scores it 9.3 (Critical); Red Hat rates it Important (CVSS 8.8). The difference is mostly about context: on a host that runs VMs for untrusted customers — VPS providers, clouds, code sandboxes, CI runners — a guest-to-host escape is about as bad as it gets, because it breaks the wall between tenants.
Fix status (as of 21 October 2026)
- Upstream stable kernels: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11.
- Debian: fixed in linux 6.1.190-1 for Debian 12 (DLA-4841-1) and 6.12.113-1 for Debian 13 (DSA-6568-1).
- Proxmox VE: fixed in proxmox-kernel-7.0.14-24-pve (advisory PSA-2026-00068-1).
- Red Hat Enterprise Linux: RHEL 9 is fixed in kernel-5.14.0-687.59.1.el9_8 (RHSA-2026:86033) and RHEL 10.0 EUS in RHSA-2026:85979; RHEL 8 was still listed as affected.
- AlmaLinux 8, 9 and 10: patched kernels are in the testing repository (4.18.0-553.174.2.el8_10, 5.14.0-687.57.2.el9_8 and 6.12.0-211.66.2.el10_2); the production release was still pending.
- Ubuntu: all releases were still listed as vulnerable, with no fixed kernel published yet.
How to patch
Install the fixed kernel, reboot, and confirm the running kernel — a patched kernel on disk does nothing until you boot into it. On a virtualization host, migrate or shut down the guests first, because the reboot takes every VM down with it.
- Debian and Proxmox VE:
apt update && apt full-upgrade, thenreboot. Check withuname -r(on Proxmox alsopveversion -v). - RHEL, AlmaLinux and Rocky:
dnf update 'kernel*', thenrebootanduname -r. - Ubuntu: watch the Ubuntu security notice for CVE-2026-99999 and run
apt update && apt full-upgradeas soon as the fixed kernel lands.
Can't patch yet?
There is no workaround: neither the researcher, upstream nor Red Hat has published a sysctl or module setting that blocks it. What you can do is narrow the damage while you schedule the reboot — the measures Vercel describes for its own fleet: keep host kernels current, disable nested virtualization where guests don't need it, and run each VM process with the least privilege possible (for example Firecracker's jailer). None of these fixes the bug.
What it means if you rent a VPS
The vulnerable code runs on your provider's host, so the real fix is theirs: patching the hypervisor kernels and rebooting. Updating the kernel inside your own VPS does not protect you from a malicious neighbour — but do it anyway, because Red Hat notes the flaw can also be triggered locally. For the wider picture, see our write-up on Januscape, the July 2026 KVM escape, the Linux VPS hardening checklist and famous Linux vulnerabilities.
A VM is only as isolated as the host kernel underneath it. PwnEscape is fixed by patching and rebooting the host — nothing inside the guest can do it for you.