Linux kernel vulnerability ‘PwnEscape’ allows virtual machine escape

A critical vulnerability in the Linux kernel, dubbed ‘PwnEscape’ (CVE-2026-99999), has been disclosed with a CVSS score of 9.3. The flaw resides in the kernel's IPv4 network stack, specifically regarding how it handles checksum metadata. Attackers can exploit this to bypass isolation boundaries, allowing a malicious guest from a virtual machine to access host memory and potentially execute arbitrary code on the host OS.

While the issue is not a defect in KVM itself, it poses a significant risk to virtualization platforms, cloud providers, and container sandboxes. Security researchers predict that exploits for weaker configurations could emerge within weeks, with those targeting default hypervisor configurations appearing in less than a month.

In response, Sakura Internet in Japan has suspended new applications for certain VPS and rental server services to implement countermeasures. Conversely, AWS has stated that its managed compute and container services, including Amazon EC2, Lambda, and Fargate, are not affected and require no action from customers. Users of Debian, Ubuntu, RHEL, and various public cloud images are urged to upgrade their kernels to patched versions immediately.