Вернуться к предупреждениям о безопасности

Kernel / KVM escape (CVE-2026-99999)

PwnEscape (CVE-2026-99999) is a Critical-rated Linux kernel vulnerability that allows a KVM guest to escape to the host: a flaw in IPv4 checksum-completion handling gives an attacker repeatable, controlled host-memory disclosure that chains into a full guest-to-host escape. The researcher confirmed host-availability failures on Linux 6.12 and 7.x hosts. DirectAdmin's announcement is a patch-now call: update the host kernel to a version containing the upstream fix (commit 6785011f8b16) and reboot.

Critical 9.3 CVSS
DirectAdmin

Команда обновления по умолчанию

cd /usr/local/directadmin/custombuild && ./build update_versions

Что это значит по лицензии SharedLicense

On any virtualized host (KVM-based VPS nodes, container sandboxes), a guest can read host memory at will and escalate to full host compromise — every tenant on the node is exposed from inside a single VM.

Get patching!


https://www.cve.org/CVERecord?id=CVE-2026-99999


https://pwn.ai/blog/pwnescape

Часто задаваемые вопросы

What is CVE-2026-99999 (PwnEscape)?
It is a Critical-rated Linux kernel vulnerability that breaks KVM isolation: a guest can trigger repeatable host-memory disclosure through IPv4 checksum-completion handling and chain it into a complete guest-to-host escape. Researchers at pwn.ai found it during Vercel's $1 million sandbox-isolation challenge announced on August 18, 2026.
Which systems are affected by PwnEscape?
Hosts running vulnerable Linux kernels that expose KVM guests — the researchers confirmed host-availability failures on Linux 6.12 and 7.x hosts. The upstream fix is kernel commit 6785011f8b16, which adds an ip_check_csum_start() guard protecting five IPv4 checksum-completion paths across six files.
How do I patch CVE-2026-99999?
Update the host kernel to a distribution build containing commit 6785011f8b16 and reboot into it. If KernelCare is installed, its live patching feed is the faster path (run kcarectl --update and verify with kcarectl --patch-info). DirectAdmin's own announcement is simply: get patching.
Why does the announcement title say CVE-2026-999999?
That was a typo in the forum thread title. The researcher's disclosure and the CVE record both use CVE-2026-99999 (five nines), and this advisory has been corrected to match the official ID.

Источники

Предупреждения о безопасности

Похожие предупреждения

Roundcube 1.7.6 / 1.6.21 security updates

2026-11-09

LiteSpeed security advisory: LSQUIC and LiteSpeed Cache for PrestaShop

2026-11-04

CVE-2026-116149 – ImageMagick vulnerability

2026-10-25

Проверьте систему на уязвимости

Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.

Проверьте свою систему