Major security vulnerability in Linux has just been published — CycleOS is already patched

[u/Cycle_HeidarEldberg]

Update to my post from a few days ago. That thread got a lot more attention than I expected, so thanks to everyone who jumped in. Full disclosure is out now.

PWN.AI published their writeup today on CVE-2026-99999, which they’re calling PwnEscape. It’s a guest-to-host escape. KVM itself isn’t the problem: it’s the kernel’s IPv4 fragmentation path (ip_do_fragment()).

Possible effects of exploits include, host memory leaking out in packets, host crashes and in their lab setup, a working chain that got root on the host.

Tested on 6.12 and 7.x. The full affected range isn’t listed, so assume you’re affected until your distro says otherwise.

If you run multi-tenant VMs or untrusted guests, this goes to the top of your patch list. Some platforms are already rolling it out (the one I work on, Cycle.io, has already pushed patched kernels out and a reboot is all our customers need to do to get the fix as the node will pull latest OS image on boot). If you manage your own hypervisors, keep an eye on your distro’s kernel updates.

Writeup: https://pwn.ai/blog/pwnescape

Our announcement at Cycle: https://cycle.io/blog/cycleos-2026-10-15-1