Linux kernel: PwnEscape flaw with suspected guest-to-host escape in KVM (CVE-2026-99999)

On October 15, 2026, Jan Schaumann posted to the oss-sec list an advisory about a Linux kernel flaw called PwnEscape, identified as CVE-2026-99999. According to the text, the flaw causes host memory disclosure and is presented as a guest-to-host escape in KVM, the kernel virtualization technology. The post says the flaw's existence was disclosed a few days earlier on social media and that a second part with more technical details should be published later. It also mentions an earlier discussion on the netdev list. The available material gives no information about affected versions, fixes or mitigations. To verify, consult the original advisory on the oss-sec list, referenced in the text itself, and follow the security notices of the Linux distribution you use and the kernel fixes. Hosts running third-party or untrusted virtual machines deserve priority attention once the details are published. Relevance to Rota Nacional: the platform is an AI model API and does not manage hypervisors or apply kernel patches. If you use AI to study the advisory, do not paste internal server names, configurations, keys or credentials.