- PwnEscape (CVE-2026-99999) sits in the Linux kernel and allows an escape from a KVM guest to the host. The rating: CVSS 3.1 with 9.8, so critical.
- Patches exist for the kernel. Distributions are catching up at different speeds; Canonical had no updates yet at the time of the report.
- What matters is the running kernel, not the installed one: without a reboot (or a live patch) the vulnerability stays open.
The strongest wall in virtualization is the one between guest and host. PwnEscape shows what happens when it lets through a packet with wrong checksum data.
What is known
Security researcher Paulos Yibelo made public on 3 October 2026 that he had developed a 0-day exploit for escaping from a KVM VM. The vulnerability was found as part of a Vercel “Sandbox” challenge that put KVM's isolation boundary to the test. It now carries the identifier CVE-2026-99999. Other experts were able to reproduce the problem independently.
The flaw lies in the network part of the kernel: if a packet with faulty checksum metadata reaches the IPv4 stack, the function skb_checksum_help can corrupt the network header during the calculation. In the escape, this defect turns into access to host memory, and in the end into root privileges on the host.
Malicious code in the guest can gain root privileges on the host. That is exactly what KVM is supposed to prevent.
What we do not know: the reports do not mention attacks in the wild, but they are expected soon. This is the phase in which you should patch, not only afterwards.
Who is affected
The kernel of the host running KVM is affected. Whoever works inside a VM usually does not manage the host themselves. The table sorts the most common roles:
| Role | Affected? | What you do |
|---|---|---|
| Your own KVM host (Proxmox, libvirt, QEMU) | Directly | Install the kernel update, reboot the host |
| Root server with your own nested VMs | Your server is the host for these guests | Treat it like a virtualization host |
| Root server without your own VMs | The host belongs to the provider | Keep your own kernel up to date, ask the provider |
| Docker host without KVM | The described path goes through KVM | Install updates anyway |
Whether your server uses nested virtualization, you can see in step 1 below. Anyone running Docker on a root server does not need KVM for it, so the Docker variant on the root server is not the normal case for this attack.
Step by step: check and secure the host
- Determine whether KVM is running. If
/dev/kvmexists and the modules are loaded, the machine is a virtualization host.ls -l /dev/kvm lsmod | grep kvm virsh list --all # libvirt qm list # Proxmox - Note the running kernel. You will compare this version number with the patched one in a moment.
uname -r - Check whether your kernel package mentions the vulnerability. Debian and Ubuntu show the CVE in the changelog, and so do RHEL derivatives. If it does not appear, the update is not there yet.
apt update apt changelog linux-image-amd64 | grep -i CVE-2026-99999 # RHEL, Alma, Rocky: rpm -q --changelog kernel | grep -i CVE-2026-99999 - Install the update. In a cluster, first move the guests to another node by live migration, then update the host.
apt full-upgrade # Proxmox: move the guest beforehand qm migrate 101 pve2 --online - Reboot and verify. Only the reboot loads the patched kernel. Afterwards
uname -rmust show a newer version than in step 2.reboot uname -r
How you know it worked
- Version comparison: The output of
uname -rafter the reboot differs from the one in step 2 and matches the package whose changelog names the CVE. - No leftover kernel: With
dpkg --list | grep linux-imageyou see which kernels are installed. The bootloader must start the newest one. - Guests are running again:
virsh listorqm listshow all VMs in the state running.
unattended-upgrades, or a weekly patch slot with a manual, supervised reboot. Both work; what matters is that a rhythm exists at all.And if the patch is still missing?
In case your distribution does not deliver yet, there is no documented workaround we could recommend here. You can still bridge the gap sensibly:
- Run only trusted guests on the host, move third-party workloads to other nodes
- Keep access to the host and the guests tight, for example with keys instead of passwords and fail2ban
- Check the package sources daily to see whether the kernel has appeared
- Relying on an update of the guests: according to the report, the flaw sits in the host kernel
- Dismissing the vulnerability as “medium” just because one distribution rates it that way
- Installing a patch but not rebooting the host
What you take away from earlier cases
The host is a rewarding target because everything below it depends on it. We have already seen this at the management layer: with Proxmox VE 7, attackers logged in as root without a password, and with Virtualizor the damage came through a planted update. PwnEscape adds the third layer to that, the kernel itself. Whoever keeps all three in view, panel, access and kernel, has to improvise less at the next report.
The same applies to the steady stream of kernel updates that admins rightly complain about. Whoever already has a fixed patch slot can react calmly to a report like this: an unscheduled reboot instead of panic. It went similarly with the privilege escalation via NetworkManager: check, update, verify.
Sources for the details are the description of CVE-2026-99999, the post on OpenWall and Yibelo's own blog post “PwnEscape: Guest-to-Host KVM Escape”. Check there before you pass anything on about the exact scope, because the reports on the vulnerability are still developing.
Do you run your own root server and don't know whether you use it as a virtualization host? The commands from step 1 settle that in ten seconds. You can find an overview of our servers under Our root servers.
