Security incidents tagged KVM. Newest first.
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Paulos Yibelo / pwn.ai found a Critical Linux networking flaw (CVE-2026-99999, CVSS 9.3) during Vercel’s $1M Sandbox challenge. Guest-controlled checksum metadata can rewrite an IPv4 header after validation, enabling host-memory disclosure and, in lab conditions, guest-to-host code execution on KVM/Firecracker. Upstream fix merged Oct 2026; host kernels need patch + reboot. Affects multi-tenant VPS / sandbox providers more than end-user desktops. Fly.io published an Oct 16 2026 postmortem of a ~10-hour fleet-wide host reboot after the CVE, saying customer data exposure was unlikely but advising rotation of credentials sent over HTTP or unencrypted 6PN between Oct 15 and 17.
Linux kernel networking (host side of KVM/Firecracker and similar)Since Oct 8, 2026
PwnEscape-Ai Research: Guest-to-Host KVM Escape (CVE-2026-99999). TLDR;- How a $1 million sandbox challenge led us to a vulnerability in Linux networking, repeatable host-memory disclosure, and ultimately a full guest-to-host escape. Blog:- t.co/CJERkG4rsE t.co/gdXbOvkklw
How can one obtain such a great identifier as CVE-2026-99999? #PwnEscape
Just uncovered: the “PwnEscape” Linux kernel flaw (CVE-2026-99999) lets guest VMs read host memory. A 9.3/10 critical issue, exposed via crafted packets in Vercel’s sandbox and patched in recent kernel versions. If you run shared Linux hosts, updating is mandatory. t.co/mqBjjVqe1d