A critical flaw in the Linux kernel is forcing virtualization hosts to patch and reboot, after a researcher showed that code inside a guest virtual machine can read memory belonging to the host itself. Tracked as CVE-2026-99999 and nicknamed PwnEscape, the vulnerability is rated critical, with a CVSS score of 9.3. It breaks one of the basic promises of cloud and sandbox platforms: that an untrusted guest stays inside its own machine.
The bug is not in KVM itself. According to AlmaLinux, which published patched test kernels on October 16, it lives in the host kernel IPv4 networking stack. When a guest sends traffic through a virtio network device, it can supply checksum offload metadata telling the host where a checksum still needs to be calculated. The host trusted that metadata without properly checking it against the packet IPv4 header, so crafted metadata could cause the checksum code to overwrite a header the kernel had already validated.
In the researcher example described by AlmaLinux, that overwrite changed the header length field from 5 to 15. Fragmentation code then treated a 20-byte header as if it were 60 bytes, opening a path to leak adjacent host kernel memory back to the guest. The researcher demonstrated three outcomes: a repeatable leak of host memory for as long as crafted packets keep coming, a crash that takes down the host and every guest on it, and, in a controlled lab setup, writes into host memory chained toward running code as root.
The distinction between those results matters. AlmaLinux says the memory leak was demonstrated against Vercel production sandboxes. The crash and root execution were shown on the researcher own KVM and Firecracker machines configured to resemble that environment, not as a confirmed takeover of a production cloud host. No real-world exploitation has been reported in the disclosures reviewed for this article, but that does not lower the urgency for operators who run guests for other people.
Researcher Paulos Yibelo of PWNAI Research found the flaw during Vercel public sandbox security challenge and reported it privately to kernel contacts on September 4, AlmaLinux says. The upstream fix, written by Michael S. Tsirkin of Red Hat, validates the checksum location before completing the checksum and was merged into the mainline kernel on October 14. Upstream describes it as a defense-in-depth measure, with more complete validation still being worked on.
The vulnerable code is old. AlmaLinux traces it to virtio network header support added in 2008 and checksum offload support added in 2010, putting the flaw in kernels for roughly 18 years. AlmaLinux 8, 9 and 10 are all listed as affected, and the project has backported the fix ahead of its upstream distribution, publishing test kernels for each release. Red Hat still listed RHEL 8, 9 and 10 as affected with no fix released at the time AlmaLinux wrote.
For enterprise teams, the action list is narrow and unavoidable. There is no published workaround, and patching a guest does not fix the host. Operators of public or private clouds, VPS hosts, and code sandbox platforms should identify every Linux host that runs untrusted guests, apply the patched host kernel from their distribution, and reboot, migrating guests first because a host reboot interrupts all of them. Managed cloud customers should still check provider advisories, since self-managed KVM hosts and managed services are not exposed in the same way.
PwnEscape is a reminder that isolation is only as strong as the host kernel underneath it. Until hosts are rebooted onto fixed kernels, that boundary should be treated as patched on paper only.