PWNAI Research has disclosed PwnEscape, a critical Linux kernel VM escape flaw tracked as CVE-2026-99999, which was demonstrated in lab tests to leak host memory from a guest VM and could potentially allow root activity on the host. The vulnerability concerns the IPv4 networking stack and arises from how the kernel handles delayed checksum calculation and metadata used to write results.
In the attack chain, a guest can influence where a write occurs, enabling later code to trust a modified IPv4 header and creating a pathway from a leaked payload to host memory writes.
The CVE carries a CVSS v3 rating of 9.3 (Critical). The flaw is described as affecting kernels back to 2.6.27, with a broad impact across multiple kernel series. Affected distributions include AlmaLinux (versions 8, 9 and 10) and Red Hat, with Red Hat listing RHEL 8–10 as affected and stating no fix at the time of the report.
The upstream bug fix addresses the delayed checksum handling and associated validation, and a set of patched stable kernel versions is listed (for example, 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11). Administrators are urged to update to a fixed stable kernel or a vendor kernel containing commit 6785011f8b16, with AlmaLinux testing patches available in their repository.
Exploitation in the wild has not been confirmed, though PWNAI notes that exploit development could arrive quickly for weaker configurations and default hypervisor settings within weeks. The recommended practical response is to update promptly, migrate or shut down guests before rebooting virtualization hosts, and prioritise multi-tenant or CI environments that run untrusted code. The researchers emphasise that this remains a defence-in-depth patch, with fuller input validation still in progress.