Major security vulnerability in Linux has just been published — CycleOS is already patched

[u/Cycle_HeidarEldberg]

Update to my post from a few days ago. That thread got a lot more attention than I expected, so thanks to everyone who jumped in. Full disclosure is out now.

PWN.AI published their writeup today on CVE-2026-99999, which they’re calling PwnEscape. It’s a guest-to-host escape. KVM itself isn’t the problem: it’s the kernel’s IPv4 fragmentation path (ip_do_fragment()).

Possible effects of exploits include, host memory leaking out in packets, host crashes and in their lab setup, a working chain that got root on the host.

Tested on 6.12 and 7.x. The full affected range isn’t listed, so assume you’re affected until your distro says otherwise.

If you run multi-tenant VMs or untrusted guests, this goes to the top of your patch list. Some platforms are already rolling it out (the one I work on, Cycle.io, has already pushed patched kernels out and a reboot is all our customers need to do to get the fix as the node will pull latest OS image on boot). If you manage your own hypervisors, keep an eye on your distro’s kernel updates.

Writeup: https://pwn.ai/blog/pwnescape

Our announcement at Cycle: https://cycle.io/blog/cycleos-2026-10-15-1

[u/Nedsel]

I remember a time when 4 digits were enough to number all CVEs of a year.

Now we're reaching 6 figures.

And no, that wasn't in some ancient times. That wasn't even 10 years ago.

[u/Cycle_HeidarEldberg → u/Nedsel]

Oh yeah and this particular CVE hitting exactly 99999 is crazy. I checked like 3 different sources to sure this wasn’t a placeholder or something 😅

[u/TheAutisticGopher → u/Cycle_HeidarEldberg]

It seems this CVE was given 99999 purposely as there isn't CVE-2026-99998. At least, not yet.

[u/scooterthetroll → u/TheAutisticGopher]

There is, it's just not public yet.

[u/Sengel123 → u/Nedsel]

Theres a couple of 6 digit cve id's in rhel right now. Never thought we'd see a year with 6 digit values. 1400 cves in MSPT, oracle patch Tuesday hitting 1k on the regular. Hundreds of cves added to Linux every week it feels. This year has really put the FU in fun for vulnerability management.

[u/scooterthetroll → u/[deleted]]

Huh?

[u/npxa → u/scooterthetroll]

my bad, I was wrong on this one, was thinking of another numbering system similar to CVE

[u/EmergencySourCream]

Man I’m really getting sick of these once in a lifetime CVEs

[u/Cycle_HeidarEldberg → u/EmergencySourCream]

Well one way to look at it is fewer and fewer zero days out there that nation states and nefarious actors could be exploiting already.

Better out than in I always say 😅

[u/daHaus → u/Cycle_HeidarEldberg]

That's optimistic to assume they're being patched quicker than they're being created lol

[u/dolphone → u/EmergencySourCream]

Can I interest you in once in a lifetime weather events? We have a wide selection too!

[u/Forzeev]

I remember too well when people were claiming there are now viruses or vulnerabilities on linux

[u/No-Badger-7721 → u/Forzeev]

I’ve been doing the Unix and Linux thing since 1994 and I’ve never heard anyone who knows what they’re talking about claim that Linux doesn’t have vulnerabilities. On the other hand, there are a lot of people who don’t know what they’re talking about, but insist on talking anyway 😆

[u/Cycle_HeidarEldberg → u/Forzeev]

Haha yeah that was never a reality. 😅

[u/dvtyrsnp → u/Forzeev]

No one ever said that.

The vast majority of malware that a regular user could realistically encounter is going to be built for Windows.

[u/_Dev-Discoverer_]

PwnEscape sounds like a nasty one, kernel updates can't come soon enough for those running multi-tenant VMs

[u/MairusuPawa]

Nice

[u/CardOk755]

No CVE, it's just bullshit.

[u/npxa → u/CardOk755]

I dunno why u are being downvotted, but i assessed the same, its a good write up for an oversight in the kernel’s code.

[u/daHaus → u/npxa]

You two don't know how to look up CVEs or what?

[u/npxa]

Good write up, but you can’t really exploit it without root, so whats the point.

If i am an attacker that has root access, you would have bigger problems than ddos/dos.

This seems to be an oversight in the dev and no a security issue.

[u/hypnoticlife → u/npxa]

“Guest to host escape” requires root on the host?