A virtual machine guest can reach its own host by sending a handful of malformed IPv4 packets, according to research that has now been assigned CVE-2026-99999 and rated 9.3.
Researcher Paulos Yibelo named the flaw PwnEscape after claiming the finding in early October. The isolation he broke is the assumption hyperscale clouds are built on: guests share a host’s hardware and must never be able to see or influence one another. Lose that boundary and every VM on the box, plus any containers running in micro-VMs alongside them, becomes reachable.
The defect lives in checksum handling. As Red Hat’s Michael S. Tsirkin described it in the kernel stable tree, a packet arriving with bad checksum metadata lets skb_checksum_help corrupt the network header and cause damage. A guest already controls its own packet metadata, and the checksum offload path trusts it after earlier validation has passed.
What made the bug serious is repeatability. The write can be triggered over and over from inside a guest, which turns a narrow corruption primitive into something an attacker can shape into reliable code execution on the host.
Fixes have gone into the kernel stable tree, and the practical response is a host-side kernel update on any platform running KVM. Prioritize infrastructure that rents VM capacity to parties you do not fully trust, and treat shared tenancy as the deciding factor rather than the CVSS number alone.
For cloud customers the action is different. Ask whether the provider has patched its hypervisors, and keep workloads needing strict separation on dedicated hardware until that answer is clear.
