PwnEscape vulnerability allows guest-to-host escape in Linux KVM

A new guest-to-host escape vulnerability named PwnEscape has been identified in the Linux KVM hypervisor. Designated as CVE-2026-99999, the flaw has a CVSS rating of 9.3 and can be triggered by sending a specific set of malformed IPv4 packets. This vulnerability allows an attacker controlling a guest workload to bypass isolation boundaries and potentially access the host system.

Technical details of PwnEscape

• The vulnerability is triggered via malformed IPv4 packets.
• It involves the skb_checksum_help function within the IPv4 stack.
• Bad checksum metadata can cause network header corruption.
• The flaw allows for a guest-to-host escape, breaking the security boundary between the VM and the host.

Why it matters

Since many cloud services and businesses rely on KVM for workload isolation, this vulnerability represents a significant risk to multi-tenant environments.