Critical Linux KVM Guest-Host Escape (CVE-2026-99999) Threatens Cloud Isolation

Paulos Yibelo reported a new class of attack on the Linux KVM hypervisor, receiving the identifier CVE-2026-99999 and the name PwnEscape. The bug exploits a weakness in how the kernel handles checksum offloading metadata, allowing a guest VM to overwrite critical packet fields after validation and potentially escape to the host. Analysts at SOC Prime note that repeated exploitation could expose host memory or enable arbitrary code execution, breaking the fundamental isolation that underpins public and private clouds.

Red Hat’s advisory lists possible outcomes as code execution, denial-of-service crashes, or sensitive data leakage. While providers like AWS and Google Cloud claim their services remain safe, the fix is already progressing through the Linux kernel and will be rolled out in major distributions and virtualization platforms such as Nutanix and Proxmox. The discovery highlights a broader risk in Linux networking stacks and may prompt further scrutiny of similar checksum-related mechanisms.