PwnEscape Critical Linux Kernel VM Escape Analysis

PwnEscape (CVE-2026-99999) is a high-impact vulnerability residing in the Linux kernel's IPv4 networking stack, specifically affecting checksum offload handling. Discovered by researchers at PWNAI Research, the flaw allows an attacker controlling a guest virtual machine to send specially crafted network packets that can trigger a host kernel memory leak, crash the host, or achieve root-level code execution on the host machine. The vulnerability has been present in the kernel for approximately 18 years, tracing back to virtio network header support introduced in 2008.

The attack exploits a lack of validation for checksum metadata passed through virtio network devices. By providing malicious metadata, an attacker causes the host kernel to overwrite its own memory, leading to potential out-of-bounds reads or writes. This affects all systems running vulnerable kernels, but the risk is most acute for cloud providers, VPS hosts, and sandbox environments where untrusted guests share physical infrastructure.

AlmaLinux and Red Hat have released patched kernels for major enterprise distributions. Organizations should prioritize updating virtualization hosts and standalone systems immediately, as no effective workarounds have been identified beyond kernel patching and subsequent reboots.