--- title: "PwnEscape: Linux Kernel VM Escape and the Patch You Cannot Skip" description: "CVE-2026-99999 is a 9.3 Critical Linux kernel flaw that lets a guest VM attack its host. Patching guests does not fix it. The governance lesson for cloud isolation." url: https://policycortex.com/blog/pwnescape-linux-kernel-guest-host-escape sealed: 2026-10-22 register: blog/pwnescape-linux-kernel-guest-host-escape records: 3 digest: sha3:79064b0d2f583e8a88edf9a60a8387d162d5f9ab70c25880328e52a4ee59dd1e --- # PwnEscape: The Linux Kernel Flaw That Escapes the Virtual Machine Resources / Blog CVE-2026-99999 scores 9.3 Critical and lets a guest VM read host memory, crash the host, and run code as root. The fix is a host kernel update. Guest patches do not help. Leonard Esere · Sealed 2026-10-22 · Reading time 5 min Filed under: [PwnEscape](https://policycortex.com/blog/tags/pwnescape), [CVE-2026-99999](https://policycortex.com/blog/tags/cve-2026-99999), [Linux kernel](https://policycortex.com/blog/tags/linux-kernel), [VM escape](https://policycortex.com/blog/tags/vm-escape), [flaw remediation](https://policycortex.com/blog/tags/flaw-remediation), [NIST 800-53](https://policycortex.com/blog/tags/nist-800-53) **Summary** - CVE-2026-99999 scores 9.3 Critical. A guest VM can read host memory, crash the host, and run code as root on it. - The flaw sits in the host kernel's IPv4 stack, not in KVM. Only a host kernel update fixes it. - Affected: Linux kernels from 2.6.27 through the fixed point releases. Check your host kernels this week. - Isolation promises are only as strong as the patch state of the layer that enforces them. ## The isolation promise broke Virtualization runs on a promise. What runs inside a virtual machine (VM) stays inside the VM. PwnEscape breaks that promise. It is a flaw in the Linux kernel that lets code inside a guest VM read the host's memory, crash the host, or run code on it as root. The Common Vulnerabilities and Exposures record for [CVE-2026-99999](https://www.cve.org/CVERecord?id=CVE-2026-99999) carries a Common Vulnerability Scoring System (CVSS) 3.1 score of 9.3, Critical. The score comes from the Linux kernel security team. ## Where the flaw lives The flaw is not in KVM. KVM is Kernel-based Virtual Machine, the hypervisor behind most public and private clouds. The flaw sits in the host kernel's Internet Protocol version 4 (IPv4) networking stack. A guest controls the checksum metadata on the packets it sends. Those packets reach the host kernel's IPv4 code. Bad metadata made the kernel rewrite a packet header after the kernel had already validated it. That rewrite crossed the isolation boundary. Researcher Paulos Yibelo of pwn.ai found the flaw during Vercel's one million dollar sandbox challenge. Vercel runs KVM-based sandboxes. Yibelo reported it privately on September 4, 2026. He demonstrated host memory leaks against Vercel's production sandboxes. He also showed host crashes and root code execution on lab systems. Vercel says no report showed access to customer data. ## Which systems are affected The CVE record lists Linux kernels from 2.6.27 through the fixed point releases. The fixed versions include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, and 7.2.11. If you run KVM hosts, Firecracker microVMs, or Linux containers on shared hosts, your host kernels need the fix. Updating the guests is not enough. The vulnerable code runs on the host. ## The governance lesson Cloud security rests on layered promises. The guest promises to stay in its box. The host promises to keep the box closed. PwnEscape shows the host layer needs its own patch discipline. Many teams patch guests on schedule and treat the hypervisor as infrastructure that rarely changes. That gap is where this flaw lived for years. For continuous monitoring, the record you keep is simple. List your host kernels. Record the patched version. Record the date. Keep the vendor advisory or commit reference. An authorization boundary that includes virtualization must name the hypervisor layer and its patch state. If the package only tracks guest images, it missed the layer that enforces isolation. ## What to do this week Inventory host kernels on every KVM and container host. Compare them against the fixed versions above. Patch the hosts, then verify. If you host tenants, assume a motivated tenant can reach the flaw. Patch on the timeline of a critical flaw, not a routine update. ## Sources - [CVE-2026-99999](https://www.cve.org/CVERecord?id=CVE-2026-99999) record, CVE Program. Published October 15, 2026, updated October 19, 2026. CVSS 3.1 base score 9.3, Critical, assigned by the Linux kernel security team. - PwnEscape technical writeup, pwn.ai. https://pwn.ai/blog/pwnescape - Findings from the one million dollar Vercel sandbox challenge, Vercel. https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge - Original diagram by PolicyCortex. ## Next step Want host level patch evidence collected on a schedule, not by spreadsheet? See how [PolicyCortex](https://policycortex.com) reads it from the live tenant. **Questions on this record** **Q: What is PwnEscape?** A: A guest-to-host virtual machine escape in the Linux kernel's IPv4 stack, tracked as CVE-2026-99999 and rated 9.3 Critical by the Linux kernel security team. **Q: Does updating my virtual machines fix it?** A: No. The flaw is in the host kernel that runs the VMs. Only updating the host kernel removes it. **Q: Is it being exploited in the wild?** A: As of the CVE record's latest update, CISA's assessment records no confirmed exploitation. The researcher demonstrated it against production sandboxes and lab hosts. ## Related records Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page. - **proof.state**: [Proof of State](https://policycortex.com/proof/state). What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained. - **proof.change**: [Proof of Change](https://policycortex.com/proof/change). Who or what altered the environment, under what authority, with before and after state hashes. - **proof.agency**: [Proof of Agency](https://policycortex.com/proof/agency). What a machine was permitted to do before it acted, what it did, and what would have stopped it. - **architecture**: [Architecture](https://policycortex.com/architecture). How the chain is built and where it lives: inside your tenant, with no egress of evidence. ### Further reading in this register | Published | Entry | Reading | |---|---|---| | 2026-10-21 | [You Cannot Patch What You Forgot: PHP2Shell, LiteLLM, and Governance](https://policycortex.com/blog/php2shell-litellm-governance-proof): Two failures on October 21, 2026 made the same gap public. One hid in a language runtime. One hid in a trusted release. Governance means you can prove what runs, what version, and what you fixed. | 6 min | | 2026-10-21 | [Plex2Shell: Four Small Bugs Chained Into One Takeover](https://policycortex.com/blog/plex2shell-chained-exploit-governance-lesson): CISA added four Plex Media Server flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026. Each scores medium or high alone. Chained together, they hand attackers code execution with no login. | 5 min | Verify the record this entry describes. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book) Dates of record - **Published**: 2026-10-22 - **Last updated**: Unchanged since sealing - **Author**: Leonard Esere - **Record**: https://policycortex.com/blog/pwnescape-linux-kernel-guest-host-escape ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | HEAD | 665da97bb40f | 07322b880342 | | REC 0001 | BODY | 5efc3464dcad | 665da97bb40f | | REC 0002 | RELATED RECORDS | 79064b0d2f58 | 5efc3464dcad | Head sha3:79064b0d2f583e8a88edf9a60a8387d162d5f9ab70c25880328e52a4ee59dd1e. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.