Linux KVM guest-host escape rated critical, may represent a new way to attack penguin-powered networking

Paulos Yibelo, the researcher who in early October claimed to have found a guest-host escape flaw in Linux KVM, the hypervisor used by most hyperscale clouds, has named the flaw PwnEscape and warned it might represent a new way to attack Linux – on top of being a 9.3-rated critical nasty in its own right.

Yibelo’s work is now CVE-2026-99999.

It is a scary bug because it makes a guest-host escape possible with a few malformed IPv4 packets.

Such attacks are a nightmare security scenario because the whole point of virtualization is carving up hardware into isolated “guest” virtual machines that share a “host” server’s resources – without ever being able to see what other guests or the host are doing.

Public clouds rely on that isolation remaining impervious.

So do private clouds, because if guest/host isolation is violated, an attacker could conceivably access all the VMs on a host or pool of virtualized hardware.

Attacks on a host could give an evildoer access to thousands of VMs, plus containers because many developers now run those constructs in a micro-VM to keep them isolated.

PwnEscape makes it possible for guests to access the host, by sending a guest malformed IPv4 packets.

As explained in a message from Red Hatter Michael S.

Tsirkin in the Linux kernel stable tree, ‘If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief.” Analysis from threat-finding firm SOC Prime details the mischief.

“Linux allows network packets to carry metadata indicating where a checksum operation should begin and where its result should be written.

This optimization is legitimate and widely used for checksum offloading, but the security problem arises when less-trusted guest-controlled metadata can influence a write after the packet header has already passed earlier validation stages.” “Because the disclosure could be triggered repeatedly, an attacker controlling a guest workload could potentially collect information from a security domain that the virtual machine should not be able to inspect.

This represents a direct failure of the guest-host isolation boundary.” Red Hat’s report says the impact can potentially include “arbitrary code execution on the host, a system crash resulting in Denial of Service, or information disclosure of sensitive memory.” A new class of threat Paulos Yibelo, the researcher who found the flaw, thinks he stumbled upon a novel attack.

“As far as we know, PwnEscape exposes an entirely new class of attacks in Linux networking: untrusted checksum metadata can rewrite security-sensitive packet fields after the kernel has already validated and acted on them, undermining assumptions across the networking stack far beyond the original VM escape,” he wrote.