PolicyCortex
Request Access
Summary
  • CVE-2026-99999 scores 9.3 Critical. A guest VM can read host memory, crash the host, and run code as root on it.
  • The flaw sits in the host kernel's IPv4 stack, not in KVM. Only a host kernel update fixes it.
  • Affected: Linux kernels from 2.6.27 through the fixed point releases. Check your host kernels this week.
  • Isolation promises are only as strong as the patch state of the layer that enforces them.

The isolation promise broke

Virtualization runs on a promise. What runs inside a virtual machine (VM) stays inside the VM.

PwnEscape breaks that promise. It is a flaw in the Linux kernel that lets code inside a guest VM read the host's memory, crash the host, or run code on it as root. The Common Vulnerabilities and Exposures record for CVE-2026-99999 carries a Common Vulnerability Scoring System (CVSS) 3.1 score of 9.3, Critical. The score comes from the Linux kernel security team.

Where the flaw lives

The flaw is not in KVM. KVM is Kernel-based Virtual Machine, the hypervisor behind most public and private clouds. The flaw sits in the host kernel's Internet Protocol version 4 (IPv4) networking stack.

A guest controls the checksum metadata on the packets it sends. Those packets reach the host kernel's IPv4 code. Bad metadata made the kernel rewrite a packet header after the kernel had already validated it. That rewrite crossed the isolation boundary.

Researcher Paulos Yibelo of pwn.ai found the flaw during Vercel's one million dollar sandbox challenge. Vercel runs KVM-based sandboxes. Yibelo reported it privately on September 4, 2026.

He demonstrated host memory leaks against Vercel's production sandboxes. He also showed host crashes and root code execution on lab systems. Vercel says no report showed access to customer data.

Which systems are affected

The CVE record lists Linux kernels from 2.6.27 through the fixed point releases. The fixed versions include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, and 7.2.11.

If you run KVM hosts, Firecracker microVMs, or Linux containers on shared hosts, your host kernels need the fix. Updating the guests is not enough. The vulnerable code runs on the host.

The governance lesson

Cloud security rests on layered promises. The guest promises to stay in its box. The host promises to keep the box closed.

PwnEscape shows the host layer needs its own patch discipline. Many teams patch guests on schedule and treat the hypervisor as infrastructure that rarely changes. That gap is where this flaw lived for years.

For continuous monitoring, the record you keep is simple. List your host kernels. Record the patched version. Record the date. Keep the vendor advisory or commit reference.

An authorization boundary that includes virtualization must name the hypervisor layer and its patch state. If the package only tracks guest images, it missed the layer that enforces isolation.

What to do this week

Inventory host kernels on every KVM and container host. Compare them against the fixed versions above. Patch the hosts, then verify.

If you host tenants, assume a motivated tenant can reach the flaw. Patch on the timeline of a critical flaw, not a routine update.

Sources

Next step

Want host level patch evidence collected on a schedule, not by spreadsheet? See how PolicyCortex reads it from the live tenant.

Questions on this record
What is PwnEscape?
A guest-to-host virtual machine escape in the Linux kernel's IPv4 stack, tracked as CVE-2026-99999 and rated 9.3 Critical by the Linux kernel security team.
Does updating my virtual machines fix it?
No. The flaw is in the host kernel that runs the VMs. Only updating the host kernel removes it.
Is it being exploited in the wild?
As of the CVE record's latest update, CISA's assessment records no confirmed exploitation. The researcher demonstrated it against production sandboxes and lab hosts.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Further reading in this register

  1. You Cannot Patch What You Forgot: PHP2Shell, LiteLLM, and GovernanceTwo failures on October 21, 2026 made the same gap public. One hid in a language runtime. One hid in a trusted release. Governance means you can prove what runs, what version, and what you fixed.6 min
  2. Plex2Shell: Four Small Bugs Chained Into One TakeoverCISA added four Plex Media Server flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026. Each scores medium or high alone. Chained together, they hand attackers code execution with no login.5 min

Verify the record this entry describes.

Request AccessBook a call
Published
Last updated
Unchanged since publication
Author
Leonard Esere