Back to Security Advisories

Kernel / KVM escape (CVE-2026-99999)

PwnEscape (CVE-2026-99999) is a Critical-rated Linux kernel vulnerability that allows a KVM guest to escape to the host: a flaw in IPv4 checksum-completion handling gives an attacker repeatable, controlled host-memory disclosure that chains into a full guest-to-host escape. The researcher confirmed host-availability failures on Linux 6.12 and 7.x hosts. DirectAdmin's announcement is a patch-now call: update the host kernel to a version containing the upstream fix (commit 6785011f8b16) and reboot.

Critical 9.3 CVSS
DirectAdmin

Default Update CMD

cd /usr/local/directadmin/custombuild && ./build update_versions

What this means under a SharedLicense license

On any virtualized host (KVM-based VPS nodes, container sandboxes), a guest can read host memory at will and escalate to full host compromise — every tenant on the node is exposed from inside a single VM.

Get patching!


https://www.cve.org/CVERecord?id=CVE-2026-99999


https://pwn.ai/blog/pwnescape

Frequently Asked Questions

What is CVE-2026-99999 (PwnEscape)?
It is a Critical-rated Linux kernel vulnerability that breaks KVM isolation: a guest can trigger repeatable host-memory disclosure through IPv4 checksum-completion handling and chain it into a complete guest-to-host escape. Researchers at pwn.ai found it during Vercel's $1 million sandbox-isolation challenge announced on August 18, 2026.
Which systems are affected by PwnEscape?
Hosts running vulnerable Linux kernels that expose KVM guests — the researchers confirmed host-availability failures on Linux 6.12 and 7.x hosts. The upstream fix is kernel commit 6785011f8b16, which adds an ip_check_csum_start() guard protecting five IPv4 checksum-completion paths across six files.
How do I patch CVE-2026-99999?
Update the host kernel to a distribution build containing commit 6785011f8b16 and reboot into it. If KernelCare is installed, its live patching feed is the faster path (run kcarectl --update and verify with kcarectl --patch-info). DirectAdmin's own announcement is simply: get patching.
Why does the announcement title say CVE-2026-999999?
That was a typo in the forum thread title. The researcher's disclosure and the CVE record both use CVE-2026-99999 (five nines), and this advisory has been corrected to match the official ID.

References

Security Advisories

Related Advisories

Bind CVE-2026-94300

2026-10-22

Roundcube 1.7.5 / 1.6.20 security updates

2026-10-19

Exim CVE < 4.100.1

2026-09-18

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System