PwnEscape KVM flaw lets attackers break out to Linux hosts

Researchers at Pwn.ai found CVE-2026-99999, dubbed PwnEscape, in the Linux kernel networking stack, allowing escape from KVM virtual machines and root-level code execution on the host. The attack abuses checksum offloading to rewrite an already-validated IPv4 header, leaking host memory. A fix is merged into mainline Linux and must be applied to host kernels, not just guests.

• Flaw tracked as CVE-2026-99999 and named PwnEscape
• Header length changed from 20 to 60 bytes to leak host memory
• Patch adds validation at five checksum completion points
• AWS says EC2, Lambda and Fargate are unaffected