Security · October 21, 2026
PwnEscape vulnerability enables virtual machine escape in Linux KVM hosts
A critical security flaw named PwnEscape affects Linux servers that use the Kernel Virtual Machine, or KVM, to host virtual machines. The vulnerability allows isolated virtual machines to break out of their containment. A malicious customer of a cloud hosting provider could potentially compromise the virtualization host and manipulate the virtual machines of other customers. Initial cloud hosting providers began updating their systems over the weekend, with others expected to follow. Administrators of KVM hypervisors are advised to apply the update.
The flaw is located deep within the network code of the Linux kernel. A virtual machine can specify, via virtio metadata when submitting packets, where the kernel will later append the transport checksum. The kernel incorrectly validated this position, causing the pending checksum to land at the wrong location in memory. Researchers from pwn.ai demonstrated in a laboratory setup that an exploit could repeatedly break out of the isolated environment where each virtual machine resides. They also caused the virtualization hosts and all virtual machines on them to crash multiple times.
The researchers describe this as a new class of security flaw, which they term deferred metadata trust inversion. At its core, it is a time of check, time of use error, but it does not rely on the race condition typical of that flaw class. Only an attacker controlled delayed write operation in memory is necessary to establish such a vulnerability.
PwnEscape is the last security flaw of 2026 to receive a five digit CVE identifier, specifically CVE-2026-99999, with a CVSS score of 9.3 out of 10, classified as critical. Updated Linux kernel packages are scheduled for delivery on Monday morning from Debian, with versions 6.1.190-1 for bookworm and 6.12.113-1 for trixie. Ubuntu and Red Hat have not yet released a fix. Administrators of KVM based virtualization hosts should deploy the new kernel as soon as it is available and plan for a reboot. The researchers expect working exploits to circulate in the underground within a few weeks, which may also affect hypervisors other than KVM.
KVM is a popular alternative to commercial hypervisors such as VMware and is used by hosting providers for virtual servers. Netcup began restarting its virtualization hosts over the weekend due to PwnEscape, as confirmed by its managing director in the provider's forum. Hetzner stated that a temporary mitigation was created shortly after the publication, which detects the attack vector at the system level and compensates for it based on current knowledge. Hetzner relies on an eBPF based mitigation and therefore does not need to restart its hypervisors immediately. Customers of these hosting providers have no immediate action to take, though they should verify that their virtual servers can withstand a reboot.
The sequence of events surrounding PwnEscape highlights a current dilemma in IT security. The security researchers used GPT-5.6 Sol to search for the vulnerability and found it within three days for under 700 US dollars in token costs. However, fixing the vulnerability took considerably longer. The error correction in the Linux kernel network code was only committed on October 8.