A critical vulnerability in the Linux Kernel-based Virtual Machine (KVM), tracked as CVE-2026-99999 and dubbed PwnEscape, has been disclosed by security researcher Paulos Yibelo. Rated 9.3 on the CVSS severity scale, the flaw allows a guest virtual machine to send malformed IPv4 packets that can corrupt the host operating system's network stack, potentially enabling arbitrary code execution on the host, denial of service, or memory disclosure.
organisation
Linux KVM
Open-source virtualization technology in the Linux kernel