A critical flaw in the Linux kernel can let a virtual machine reach out of its sealed compartment and attack the physical server underneath, The Register reported Sunday, and fixes are still working their way to many systems. The bug threatens the basic promise of shared computing, that one customer’s workload cannot touch another’s, and puts the burden on organizations that run their own virtualization servers to patch and reboot them.
What Happened
The flaw, tracked as CVE-2026-99999 and nicknamed PwnEscape by researcher Paulos Yibelo, sits in the code Linux uses to handle IPv4 network traffic. A virtual machine, or VM, is a software-only computer that shares a physical server, the “host,” with other VMs. On Linux, that sharing is usually managed by KVM, the hypervisor built into the kernel. According to Red Hat’s advisory, a guest VM or local attacker can send packets with malformed checksum information, a field used to detect corrupted data, that cause the host kernel to write outside the memory it should. The possible results are code running on the host, a crash that takes the host and its VMs down, or leaks of host memory.
Yibelo’s write-up for PWNAI Research says the team found the bug in about three days, with humans directing the work and OpenAI’s GPT-5.6 Sol model doing much of the code analysis, at under $700 in usage fees. The bug surfaced during Vercel’s $1 million Sandbox security challenge. Yibelo reported the root cause privately to kernel maintainers Sept. 4, and the fix reached the main Linux tree Oct. 14. CSO Online reported that fixes cover the 5.10, 5.15, 6.1, 6.6, 6.12, 6.18 and 7.2 kernel branches, and that Vercel said no reports showed anyone accessing customer data in its sandbox.
In his lab, Yibelo demonstrated host memory leaks, host crashes and, on a test machine he owned, running a command as the host’s administrator. He says that does not show code execution in any vendor’s production environment.
Patch Status
AWS said Oct. 15 that EC2, Lambda and Fargate are not affected and need no customer action. Customers who run their own KVM virtual machines with the common virtio-net network driver, including through the Firecracker micro-VM tool, on unpatched kernels 4.4 through 6.18 must install fixed kernels and reboot; AWS said there is no workaround. Debian fixed its current release in a kernel update Oct. 16 and its previous release separately, according to its security tracker.
Red Hat lists every kernel stream it tracks as affected, says fixes are in progress and says no mitigation meets its standards. The Register said Ubuntu is also picking up the fix and hoped it would reach KVM-based products such as Nutanix and Proxmox.
The severity ratings differ. The official CVE record scores the flaw 9.3 out of 10, critical. Red Hat rates it “Important” at a preliminary 8.8 because it assumes an attacker already needs some access rights on the system; that is the only difference between the two scores.
Why It Matters
Public clouds, private clouds and services that run untrusted code in disposable VMs, including sandboxes for AI agents, depend on the wall between guest and host. A break in that wall can expose every other workload on the same server. Hyperscalers’ managed services say they are covered, so the exposure falls mainly on enterprises, hosting firms and software providers that operate their own KVM fleets. Because the fix needs a reboot, it competes with uptime commitments, and that is a decision for operations leaders, not only security teams.
The finding is also another sign that AI-assisted research is surfacing serious bugs quickly and cheaply. Yibelo argues it exposes a new class of Linux networking flaw in which different parts of the kernel trust different versions of the same packet, and he calls the upstream fix a defense-in-depth measure with broader validation still needed.
What to Watch
- Red Hat and Ubuntu kernel releases, and advisories from KVM-based platforms such as Nutanix and Proxmox.
- Any public exploit. Yibelo expects exploits for weaker setups within weeks and for default hypervisor setups within about a month. CISA’s catalog of known exploited vulnerabilities did not list the flaw, and none of the reporting describes attacks, though Red Hat’s page labels it a “KEV active-exploit case” without explanation.
- Yibelo’s promised follow-up on turning the bug into full host control.
