PwnEscape (CVE-2026-99999) is a flaw in the Linux host kernel’s IPv4 networking path that can be reached through a guest-facing KVM and virtio-net connection. The vulnerable code is in Linux networking, not in KVM itself, as the upstream kernel change makes clear.
That distinction matters when you assess exposure: the guest provides a route to the flaw, but the affected code runs in the host kernel.
Where PwnEscape lives
KVM runs virtual machines, and virtio-net can connect a guest’s network traffic to the host. PwnEscape involves checksum processing in the host’s Linux IPv4 stack. It is not a bug confined to the guest’s own Linux installation.
A checksum lets a system check whether packet data has been corrupted. With checksum offloading, some of that work can be deferred. In his technical account of PwnEscape, researcher Paulos Yibelo describes guest-controlled checksum metadata reaching a later checksum operation, where a write altered an IPv4 header that the kernel had already processed.
How the header change led to a disclosure
The IPv4 header includes an Internet Header Length, or IHL, field. In Yibelo’s controlled packet geometry, the header was initially interpreted as 20 bytes, then read as 60 bytes after the deferred checksum write changed that field. Fragmentation later relied on the altered length.
The packet had 28 bytes of logical linear data: a 20-byte IPv4 header plus 8 bytes of payload. Interpreting the header as 60 bytes left a 32-byte gap between that data and the length used by the fragmenter. Yibelo reports that the resulting operation copied 32 bytes of host memory into transmitted fragments. He describes the disclosure as repeatable in the research and Vercel sandbox context.
The disclosure and the root-helper chain were separate results
Yibelo also reports selected 64-byte host-kernel writes and a host-root helper chain that completed across four true-cold boots in his own KVM fixture. Those results came from that research setup, separately from the reported 32-byte disclosure.
What the upstream fix changes
The accepted Linux patch adds a check that rejects checksum start locations inside an IPv4 header. The check runs before checksum completion at five consumers. Yibelo describes the change as defense in depth.
On October 15, 2026, The Hacker News listed these upstream stable fixed-version thresholds: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11. Vendor kernels may backport the fix under different package versions, so an upstream version threshold is not a substitute for the relevant vendor’s package advisory.
AWS-managed services and customer-run hosts
AWS’s October 15, 2026 security bulletin distinguishes its managed services from customers’ self-managed KVM hosts:
| Environment | AWS’s stated scope |
| AWS-managed EC2, Lambda and Fargate | AWS says these services are not affected. |
| Customer-managed KVM/virtio-net hosts on affected, unpatched kernels | AWS says these hosts are affected. |
For the second group, AWS recommends installing the applicable host-kernel update and rebooting. The vulnerable path is in the host kernel, so updating only a guest’s kernel does not address it.
Why CVSS 3.1 scores differ
The Red Hat advisory lists both its product-specific assessment and the score from cve.org. They use different values for the CVSS Privileges Required metric:
| Assessment | CVSS 3.1 score | Privileges Required | Severity |
| cve.org | 9.3 | PR:N | Critical |
| Red Hat product assessment | 8.8 | PR:L | Important |
