Researcher Paulos Yibelo, who in early October said he had found a guest to host escape flaw in Linux KVM, has named the flaw PwnEscape and warned it may represent a new way to attack Linux. The work is now tracked as CVE-2026-99999 and rated 9.3. KVM is the hypervisor used by most hyperscale clouds, and a guest to host escape breaks the isolation on which public and private clouds depend: an attacker who reaches the host could in principle reach other virtual machines on the same hardware.
The flaw does not live in KVM’s own code. It sits in the host kernel’s IPv4 networking path. Guests can supply checksum offload metadata saying where a checksum should start and where its result should be written. Red Hat’s Michael S. Tsirkin, writing in the Linux kernel stable tree, explained that if a packet with bad checksum metadata gets into the IPv4 stack, the checksum helper can corrupt the network header. In the researchers’ lab work that produced a repeatable leak of 32 bytes of host memory per case, a host crash on test machines, and controlled writes into host kernel memory that were chained into running a helper as root on the host. The researchers do not claim the full chain works against any provider’s production environment.
Yibelo argues the root cause is broader than one bug: untrusted checksum metadata can rewrite security sensitive packet fields after the kernel has already validated them, so different parts of Linux were allowed to trust different versions of the same packet. Threat analysis firm SOC Prime made the same point about guest controlled metadata influencing a write after earlier validation stages had passed.
The practical position is narrower than the headline. Amazon Web Services, which runs its cloud on KVM, says its Elastic Compute Cloud is not at risk, and Google Cloud’s method of using KVM means it is probably in the clear too, The Register reported. An upstream fix has been created in the Linux kernel and is moving into major distributions including Debian, RHEL and Ubuntu, and into virtualization products that rely on KVM such as Nutanix and Proxmox. Red Hat’s own assessment says the impact can potentially include arbitrary code execution on the host, a system crash, or disclosure of sensitive memory, which is why host patching, not guest patching, is the urgent task.