The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
KVM escape exposes broader attack surface in Linux networking
- Published
- Record updated
Summary
Pwn.ai researchers disclosed CVE-2026-99999, dubbed PwnEscape, a flaw in the Linux kernel's IPv4 networking code that can let an attacker escape a KVM virtual machine and execute code on the host. The bug stems from checksum offloading, where guest-controlled metadata rewrites an already-validated IPv4 header, enabling host memory leakage. Vercel confirmed the findings but said no customer data was accessed.
Mitigation
A fix was merged into the mainline Linux kernel and patched kernel versions are available for multiple distributions. Administrators must deploy the kernel updates on host systems, since updating only guest VMs does not fix the vulnerability.