Overview of the KVM Vulnerability
A high-severity security flaw, designated CVE-2026-99999 and nicknamed PwnEscape, has been identified in the Linux Kernel-based Virtual Machine (KVM). KVM is the technology that allows a Linux operating system to act as a hypervisor—software that creates and runs virtual machines (VMs).
In a standard configuration, a VM is isolated from the physical hardware and other VMs. This vulnerability allows an attacker with access to a guest VM to bypass these boundaries and execute code on the host server. The issue has received a CVSS severity rating of 9.3 out of 10.
Technical Context
The flaw relates to how the Linux kernel handles specific networking instructions between the guest and the host. Security researchers found that by sending malformed data packets, it is possible to trigger a memory error that grants the guest machine unauthorized access to the host's memory.
This is particularly relevant for businesses using Linux-based networking tools, such as software-defined firewalls or load balancers, where the system is designed to process high volumes of traffic. If a host server is compromised, every other virtual machine running on that same hardware is also at risk, as the attacker could potentially view or steal data across the entire system.
Action Required for UK Businesses
Most small and medium businesses do not manage the Linux kernel directly but interact with it through distributions like Ubuntu, Red Hat, or Debian, or via cloud providers.
If your business manages its own on-premise servers running Linux virtualization, you should check for kernel updates immediately. Most major Linux distributions are currently preparing or releasing patches to address this specific exploit.
For businesses using third-party hosting or cloud services, the responsibility for patching the host hardware lies with the provider. We recommend contacting your provider to ensure their hypervisors have been updated against CVE-2026-99999. There is currently no evidence that this flaw is being exploited widely in the wild, but the critical rating suggests that updates should be treated as a priority.