AlmaLinux ships critical PwnEscape kernel patches ahead of RHEL

A critical Linux kernel vulnerability nicknamed PwnEscape (CVE-2026-99999) allows guest VMs to escape to the host via malformed IPv4 checksum metadata, enabling memory leaks, host crashes, or root code execution. The flaw has existed in the kernel since 2008-2010. AlmaLinux's technical steering committee approved shipping patched kernels for versions 8, 9, and 10 ahead of RHEL, which had not released fixes at time of writing. The distribution is requesting community testing before promoting the builds to production repositories.

How the PwnEscape vulnerability works

• Root cause: Host kernel's IPv4 networking stack trusts checksum offload metadata from guest VMs without validating it against the packet header
• Attack vector: Specially crafted network packets via virtio network devices with bad checksum_start values
• Demonstrated impacts: Repeatable host kernel memory leak to attacker; host crash taking down all VMs; arbitrary kernel memory writes chained to root code execution
• Vulnerable code age: Introduced in Linux 2.6.27 (2008) for tun/tap virtio headers and extended in 2010 for packet sockets—approximately 18 years in all kernels
• Upstream fix: Commit 6785011f8b16 by Michael S. Tsirkin validates checksum_start before completing checksum; merged to mainline 2026-10-14
• Local attack possible: Red Hat notes local attackers can also trigger the flaw, not just guest VMs; no workaround exists besides patched kernel

Why it matters

AlmaLinux's decision to ship ahead of RHEL demonstrates how RHEL-compatible rebuilds can move faster than upstream on critical security issues, though it also places testing burden on the community. The vulnerability's 18-year presence and ease of exploitation from guest VMs makes it particularly dangerous for multi-tenant virtualization hosts and sandbox platforms.