Paulos Yibelo

Security · 19 Oct 2026Critical Linux KVM Flaw PwnEscape Enables Novel Guest-to-Host Attack

A critical vulnerability in the Linux Kernel-based Virtual Machine (KVM), tracked as CVE-2026-99999 and dubbed PwnEscape, has been disclosed by security researcher Paulos Yibelo. Rated 9.3 on the CVSS severity scale, the flaw allows a guest virtual machine to send malformed IPv4 packets that can corrupt the host operating system's network stack, potentially enabling arbitrary code execution on the host, denial of service, or memory disclosure.