# PwnEscape vulnerability allows guest-to-host escape in Linux KVM

> **Key takeaway:** A critical KVM vulnerability, CVE-2026-99999, allows attackers to escape virtual machine isolation using malformed IPv4 packets.

**Published:** 2026-10-22T16:18:31+00:00 
**Source:** Linux Magazine News 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/pwnescape-vulnerability-allows-guest-to-host-escape-in-linux.html 

## Summary
A new guest-to-host escape vulnerability named PwnEscape has been identified in the Linux KVM hypervisor. Designated as CVE-2026-99999, the flaw has a CVSS rating of 9.3 and can be triggered by sending a specific set of malformed IPv4 packets. This vulnerability allows an attacker controlling a guest workload to bypass isolation boundaries and potentially access the host system.

## Technical details of PwnEscape
- The vulnerability is triggered via **malformed IPv4 packets**.
- It involves the **skb_checksum_help** function within the IPv4 stack.
- Bad checksum metadata can cause **network header corruption**.
- The flaw allows for a **guest-to-host escape**, breaking the security boundary between the VM and the host.

## Why it matters
Since many cloud services and businesses rely on KVM for workload isolation, this vulnerability represents a significant risk to multi-tenant environments.