PwnEscape (CVE-2026-99999)

PwnEscape is a Linux kernel flaw that lets a guest virtual machine attack the host it runs on. Guests on KVM hosts using virtio-net/TAP networking can attach checksum offload metadata to their packets, telling the host where to write the checksum later. The host kernel validated the IPv4 header first, then trusted that guest-supplied offset and wrote two bytes into the header it had already checked: a time-of-check to time-of-use bug.

Paulos Yibelo of pwn.ai found it during Vercel's $1 million Sandbox challenge, with AI-assisted bug hunting. The researcher showed a repeatable leak of host kernel memory (Vercel says this was demonstrated on its production sandboxes), a host crash that takes down every VM on it, and, root code execution on the host; on 9 November he showed a full escape from a Firecracker microVM to root on the host. The underlying code dates back to Linux 2.6.27 in 2008.

As of the latest reports there is no known exploitation in the wild, and it is not in KEV. Patched kernels are out (AlmaLinux shipped them on 16 October), and AWS says EC2, Lambda and Fargate are not affected. Priority goes to hosts running guests you do not control (cloud, CI runners, malware sandboxes) and shared servers where untrusted users have a shell.