Linux Kernel Vulnerability Enables KVM Guest Escape
Researchers at PWN.AI have disclosed a Linux kernel vulnerability, CVE-2026-99999, which can lead to a 32-byte host memory leak. They demonstrated a guest-to-host escape in their own KVM environment. A fix has been submitted to Linux, and the relevant patch was merged into the mainline kernel on October 14, 2026.
PWN.AI researchers have disclosed a Linux kernel vulnerability, CVE-2026-99999. This vulnerability allows an attacker to rewrite IPv4 headers after the kernel has completed its checksum validation of network metadata, resulting in a 32-byte leak of host memory information. The research team also demonstrated an escape from a guest virtual machine to the host machine within their own KVM environment.
A fix for Linux has been submitted, and the relevant patch was merged into the mainline kernel on October 14, 2026.
PWN.AI Security Research
