Linux KVM guest-host escape rated critical, may represent a new way to attack penguin-powered networking

Party like it’s CVE-2026-99999 – a 9.3-rated nasty called PwnEscape

Paulos Yibelo, the researcher who in early October claimed to have found a guest-host escape flaw in Linux KVM, the hypervisor used by most hyperscale clouds, has named the flaw PwnEscape and warned it might represent a new way to attack Linux – on top of being a 9.3-rated critical nasty in its own right.

Yibelo’s work is now CVE-2026-99999. It is a scary bug because it makes a guest-host escape possible with a few malformed IPv4 packets.

Such attacks are a nightmare security scenario because the whole point of virtualization is carving up hardware into isolated “guest” virtual machines that share a “host” server’s resources – without ever being able to see what other guests or the host are doing. Public clouds rely on that isolation remaining impervious. So do private clouds, because if guest/host isolation is violated, an attacker could conceivably access all the VMs on a host or pool of virtualized hardware. Attacks on a host could give an evildoer access to thousands of VMs, plus containers because many developers now run those constructs in a micro-VM to keep them isolated.

REG AD

PwnEscape makes it possible for guests to access the host, by sending a guest malformed IPv4 packets.

REG AD

As explained in a message from Red Hatter Michael S. Tsirkin in the Linux kernel stable tree, ‘If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief.”

Analysis from threat-finding firm SOC Prime details the mischief.

“Linux allows network packets to carry metadata indicating where a checksum operation should begin and where its result should be written. This optimization is legitimate and widely used for checksum offloading, but the security problem arises when less-trusted guest-controlled metadata can influence a write after the packet header has already passed earlier validation stages.”

“Because the disclosure could be triggered repeatedly, an attacker controlling a guest workload could potentially collect information from a security domain that the virtual machine should not be able to inspect. This represents a direct failure of the guest-host isolation boundary.”

Red Hat’s report says the impact can potentially include “arbitrary code execution on the host, a system crash resulting in Denial of Service, or information disclosure of sensitive memory.”

A new class of threat

Paulos Yibelo, the researcher who found the flaw, thinks he stumbled upon a novel attack.

“As far as we know, PwnEscape exposes an entirely new class of attacks in Linux networking: untrusted checksum metadata can rewrite security-sensitive packet fields after the kernel has already validated and acted on them, undermining assumptions across the networking stack far beyond the original VM escape,” he wrote.

REG AD

“The popular mental model is that VM isolation lives in the virtual-machine monitor. Much of it does. But an attacker-controlled workload does not interact only with arch/x86/kvm/. It interacts with a host OS full of optimized, highly composable interfaces.”

“If the metadata crosses a trust boundary, every deferred consumer has to inherit the right invariants. And if the packet can be transformed after those invariants are checked, the invariants have to remain true in the new representation.”

“That is why a bug that looks, at first, like a malformed checksum hint can become a memory disclosure and a guest-to-host escape primitive. The problem was not how difficult IPv4 is to parse. It was that different parts of Linux were allowed to trust different versions of the same packet.”

That’s an important observation, because while Linux KVM is widely used, and free, it is part of Linux – a project comprised of over 40 million lines of code.

A vendor named Edera, which offers a secure container runtime based on the Xen hypervisor, last week none-too-gently pointed out that’s a big attack surface and that researchers have found seven escape bugs this year alone including Januscape.

AWS, which runs its cloud on KVM, says its elastic compute cloud is not at risk. Google Cloud’s method of using KVM means it is probably in the clear, too. Developers have created an upstream fix in the Linux kernel. It’s percolating into major distros like Debian, RHEL, and Ubuntu and hopefully into virtualization products that rely on KVM, such as Nutanix and Proxmox. 

In the age of AI, miscreants will doubtless quickly explore Yibelo’s discoveries, making PwnScape potentially quite a moment for Linux developers and users. ®