A tenant on a shared cloud server can send a crafted network packet and read host kernel memory. In a lab, researchers chained that access into code execution inside the Firecracker process, but only with an unpatched kernel and no jailer.
The fix is in seven stable kernel branches and Linux 7.3. Patching remains uneven: Ubuntu marked its 26.10 standard kernel fixed on November 7, while standard kernels for 22.04, 24.04 and 26.04 and the 22.04 linux-kvm package were still in progress. AlmaLinux moved patched kernels into production on October 23, and Nutanix's October 27 advisory covers its whole stack.
Why it matters
A cloud tenant who controls one guest VM can compromise the host and every other virtual machine running on it.
Questions about this story
Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.
No questions yet — be the first to ask.
Key Indicators
7
Stable kernel branches patched
Releases 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11 carry the fix.
9.3
CVSS severity score
Rated Critical by both Red Hat and the Linux kernel CVE team.
4
Ubuntu kernel rows still in progress
Standard linux for 22.04, 24.04 and 26.04, plus linux-kvm for 22.04, remained in progress on November 7; 26.10 was fixed.
5
IPv4 checksum consumers patched
Michael Tsirkin's fix adds an IPv4-specific guard in five affected code paths.
6
Files named in the CVE record
Among them net/ipv4/ip_output.c; the flaw dates to kernel 2.6.27.
16 events
Latest: 4 days ago
Showing 8 of 16
JK to step
Tap a bar to jump to that date
Jump to
November 2026
Ubuntu marks 26.10 kernel fixed
LatestMitigation
Canonical's tracker marked the standard linux package for Ubuntu 26.10 fixed in 7.3.0-10.10; four other package-and-release rows remained in progress.
Firecracker escape chain demonstrated
Research
PWNAI's second PwnEscape write-up shows a host memory primitive turned into code execution inside the Firecracker process in a lab; the demo required an unpatched host kernel and a Firecracker setup without the jailer.
October 2026
Akamai publishes PwnEscape mitigation guidance
Mitigation
Akamai says its hypervisors are patched, lists updated base images for several distributions, and notes that guest kernels may still be vulnerable in containers or nested virtualization.
Nutanix advisory covers its whole stack
Disclosure
Nutanix Security Advisory #0059, rated Critical, covers all versions of AOS, AHV, Prism Central, NKP, MSP and Objects.
AlmaLinux moves patched kernels to production
Mitigation
Kernels with the PwnEscape fix reach production repositories for AlmaLinux 8, 9 and 10; users no longer need the testing repo.
Red Hat, Ubuntu and SUSE still list no fixed kernel
Mitigation
A check of distributor CVE pages four days after the stable releases found Red Hat listing all 11 product rows affected and SUSE listing 167 of 167, while Debian, Amazon Linux, Oracle Linux and Azure Linux showed fixed kernels.
Linux 7.3 released with the fix
Mitigation
The mainline 7.3 release carries the IPv4 checksum guard that went into 7.3-rc7.
Live patches reach major distributions
Mitigation
TuxCare ships live patches for Enterprise Linux 9; EL10 patches enter testing.
AlmaLinux ships patched kernels
Mitigation
Patches land in the testing repository for releases 8, 9, and 10.
CVE-2026-99999 published
Disclosure
Linux kernel CNA publishes the Critical-rated CVE; the researcher's write-up follows.
Stable kernels with the fix released
Mitigation
Greg Kroah-Hartman released stable kernels 7.2.11, 6.18.57, 6.12.113, 6.6.159, 6.1.190, 5.15.223 and 5.10.272, each carrying the IPv4 checksum fix.
Fix merges into mainline
Development
Patch reaches Linus's tree; Vercel confirms production host-memory leak.
Fix applied to net.git
Development
Michael Tsirkin's IPv4 checksum guard lands in the networking tree.
September 2026
Flaw reported privately
Disclosure
Paulos Yibelo reports the bug to the kernel security contact and networking maintainers.
2010
Checksum offload support widens exposure
Development
Checksum offload support for packet sockets extends the reach of the flaw.
2008
Vulnerable code enters the kernel
Development
Virtio network header support for tun/tap devices added in Linux 2.6.27.
Scenarios
1
PwnEscape exploit code goes public
Likely
Resolves by Q1 2027
Discussed by: PWNAI Research and the researcher's blog
PWNAI published the second part of its PwnEscape research on November 7. It describes a lab chain from host memory access to code execution inside the Firecracker process, but the write-up does not say a working exploit was released.
2
PwnEscape added to CISA known-exploited catalog
Possible
Resolves by Q2 2027
Discussed by: CISA vulnerability management teams
No active exploitation has been reported as of mid-October. Smaller and slower-patching hosts are the most likely targets. If attackers begin using the flaw in the wild, CISA typically adds it to its known-exploited catalog, forcing federal agencies to patch within set deadlines.
3
Complete input-side fix lands upstream
Likely
Resolves by Q2 2027
Discussed by: Linux kernel networking maintainers
The merged fix is a defense-in-depth guard before checksum completion. Upstream states a more complete validation at input 'is forthcoming.' Merging it would close the root cause and remove reliance on the output-side check, which the current patch leaves in place for defense in depth.
4
Working exploits appear within a month
Likely
Resolves by Nov 22, 2026
Discussed by: PWNAI researchers, in comments to CSO Online
The researchers say the full exploitation steps are being held for a follow-up article, but they expect exploits for weaker hypervisor configurations in weeks and for default configurations in under a month. That timeline would put working code in attackers' hands while virtualization hosts remain unpatched.
Historical Context
2 moments from history that rhyme with this story — and how they unfolded.
1 of 2
May 2015
Venom (2015)
CrowdStrike researcher Jason Geffner found a buffer overflow in QEMU's virtual floppy disk controller. A guest could overflow the buffer and escape to the host, affecting major cloud providers including Amazon Web Services and others using the default floppy driver.
Then
Cloud providers raced to patch or disable the vulnerable controller; the bug never saw widespread exploitation.
Now
Established VM escape as a known risk for shared cloud infrastructure and pushed providers to harden hypervisor defaults.
Why this matters now
Like PwnEscape, Venom let a guest break isolation and reach the host — only through emulated hardware rather than the kernel network stack.
2 of 2
April 2014
Heartbleed (2014)
A missing bounds check in OpenSSL's heartbeat extension let remote attackers read 64KB chunks of server memory at a time. The bug went unnoticed for about two years, exposing passwords, session keys, and private data on millions of servers.
Then
OpenSSL 1.0.1g patched it; sites rushed to update and rotate keys.
Now
Spurred the OpenSSL foundation and industry coordinators, and became the template for memory-disclosure incidents.
Why this matters now
Both flaws produce a continuous, repeatable leak of host memory to an attacker — Heartbleed from the network, PwnEscape from inside a guest VM.
