CVE-2026-99999 "PwnEscape": critical kernel flaw for VM-to-host escape

A flaw in the Linux kernel, classified as CVE-2026-99999 and nicknamed "PwnEscape", enables a guest virtual machine to corrupt the memory of the host running it. CloudLinux published the patch status for all its kernel lines on 16 October 2026: none currently have a stable fix available. For those renting VPS on KVM hypervisors, this directly affects the security model: the attacker is the customer themselves.

What the flaw does

The issue lies in the handling of checksum offload in virtio-net. An untrusted guest can overwrite two bytes of an IPv4 header already validated on the host. The researcher reports memory leakage from the host, host crashes and root-level code execution on a test host. The discovery is credited to researcher Paulos Yibelo, who demonstrated it against Vercel's production sandboxes: each packet sent by the guest could leak approximately 32 bytes of host memory, and the guest could continue as long as it kept sending packets.

The bug dates back to Linux kernel version 2.6.27, so every CloudLinux kernel line should contain it. Upstream, the fix has already arrived: Greg Kroah-Hartman released seven Linux stable kernel updates (7.2.11, 6.18.57, 6.12.113, 6.6.159, 6.1.190, 5.15.223 and 5.10.272) that include the correction signed by patch author Michael S. Tsirkin.

Status on CloudLinux

According to CloudLinux's official status page, updated 16 October at 11:21 UTC, the KernelCare livepatch is rolling out to the test feed for the EL9 family, with patchsets K20261016_0001 (RHEL 9), K20261016_0002 (AlmaLinux 9 and CloudLinux 9), K20261016_0004 (Oracle Linux 9) and K20261016_0005/0006 (Rocky Linux 9), and is expected on the main feed later that day. For the other lines — CloudLinux 7h, 8, 8 LTS, 9 LTS and 10 — there is yet no patched kernel nor a published livepatch.

Mitigation, with caveats

The proposed mitigation has not been tested against this specific bug. For hosts running untrusted VMs, checksum offload can be disabled on the QEMU side with -device virtio-net-pci,netdev=n0,csum=off,guest_csum=off, at the cost of reduced network throughput on the guest. For shared hosting without VMs, the local path can be closed by disabling unprivileged user namespaces with sysctl -w user.max_user_namespaces=0, but this breaks rootless containers and Chrome and Flatpak sandboxes.

Checking your exposure

To see if a CloudLinux server is patched: compare uname -r with the target version for your kernel line, or run kcarectl --patch-info | grep CVE-2026-99999 once the livepatch is available. To check if the local path is open on shared hosting: sysctl user.max_user_namespaces — a value of 0 means tenants cannot create one.