Key points
- CVE-2026-99999 is rated Critical with a CVSS score of 9.3 by the National Vulnerability Database.
- The flaw affects KVM-based hypervisors running unpatched Linux kernel versions 4.4 through 6.18.
- AWS-managed services like EC2 and Lambda are not affected, but self-managed VMs require immediate updates.
Security operations teams must update Linux kernel versions 4.4 through 6.18 on KVM-based hypervisors to address CVE-2026-99999. This critical flaw, rated 9.3 by the National Vulnerability Database, allows attackers inside guest virtual machines to corrupt host kernel memory. Amazon Linux has released fixed kernel packages for affected versions, while other distributions should apply vendor updates. AWS-managed compute services remain unaffected.
In plain English
The Linux kernel sometimes delays calculating network packet checksums to improve performance. Packet metadata tells the kernel where to start and end this calculation. However, if an attacker sends a packet with bad metadata, the kernel can write incorrect data into the IPv4 header. This corrupts the network header and can lead to host memory disclosure or denial of service.
The background
Researcher Paulos Yibelo of pwn.ai discovered the flaw, nicknamed PwnEscape. He demonstrated that specially crafted packets from a guest VM could read host memory, crash the host, or execute code. Vercel confirmed the memory leak against its production sandboxes. The researcher noted that two crafted packets were enough to crash a host in lab tests, taking down all running sandboxes.
What changes now
Amazon Linux users must apply specific kernel updates and reboot their host systems. For Amazon Linux 2, kernels 4.14.355, 5.4.302, 5.10.269, and 5.15.220 include the fix. Amazon Linux 2023 users should update to kernels 6.1.188, 6.12.110, or 6.18.51. Customers using other Linux distributions must apply kernel updates from their respective operating system vendors.
Who needs to act first
Teams should prioritize updating hosts that run untrusted workloads in virtual machines. Since the flaw allows guest-to-host escape, systems processing external or multi-tenant traffic face the highest risk. Apply kernel updates during maintenance windows and verify successful reboots. Monitor guest network traffic for anomalies while waiting for patches. Ensure backup procedures are current before performing mass updates to avoid service disruptions during the remediation process.
What to do and how to stay safe: Linux kernel
- Inventory all systems running Linux kernel versions 4.4 through 6.18 with KVM hypervisors.
- Check vendor advisories for available kernel updates and test them in non-production environments.
- Monitor guest virtual machine network traffic for unusual packet patterns or high volumes.
- Restrict privileged access inside guest VMs to limit the ability to send crafted packets.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability affect AWS-managed services like EC2?
No, AWS-managed compute and container services, including Amazon EC2, Lambda, and Fargate, are not affected by this issue.
What is the CVSS score for CVE-2026-99999?
The National Vulnerability Database rates the flaw as Critical with a CVSS score of 9.3 out of 10.
Are there any workarounds for this vulnerability?
There are no workarounds for this issue; customers must apply the updated kernel packages provided by their operating system vendor.
