PwnEscape CVE-2026-99999: KVM escape status for CloudLinux

CVE-2026-99999, nicknamed PwnEscape, is a CVSS 9.3 Linux kernel flaw in how IPv4 fragmentation handles checksum metadata supplied by virtio-net. A malicious VM guest can make the host's skb_checksum_help() write into an IPv4 header that was already validated. In the researcher's lab that leaked host heap memory, crashed the host, and was chained to root on the hypervisor. The fix reached mainline on 14 October 2026, the kernel CNA published the CVE on 15 October, and CloudLinux issued its status on 16 October.

The bug dates back to Linux 2.6.27, so every CloudLinux kernel line carries it. No public exploit exists and CloudLinux has not reproduced the attack, but the guest-to-host path needs nothing more than a VM you rent out.

Who is exposed

The local route uses tun with IFF_VNET_HDR or AF_PACKET with PACKET_VNET_HDR inside a user namespace. Unprivileged user namespaces are on by default from CloudLinux 8 onwards, and CageFS does not block this. In CloudLinux's tests on 7h, 8, 8 LTS, 9, and 9 LTS, the local path produced no oops and no KASAN report, so treat it as unproven rather than safe.

Status by CloudLinux branch

As of the 16 October advisory, no fixed kernel had shipped on any branch.

Third-party trackers checked on 18 October still showed no fix in AlmaLinux 9 or 10 stable BaseOS. Debian already ships fixed kernels, which matters if you run Proxmox-style Debian hypervisors next to your CloudLinux nodes.

Livepatch first on CloudLinux 9

On CloudLinux 9 KernelCare is the only fix available today. CLN-licensed servers pick it up automatically. Force it and check:

kcarectl --update
kcarectl --patch-info | grep CVE-2026-99999

CloudLinux's advisory warns that the CVE listing may lag the patch itself. If the grep is empty, run kcarectl --info and confirm the effective patch level has moved to the 16 October release before you assume you're unprotected. Servers behind ePortal follow your ePortal feed rules, so push the patch through your ePortal channel rather than waiting for the default schedule.

TuxCare notes that the upstream commit implies a follow-up fix. Expect a second livepatch and recheck after it lands.

Mitigations until a kernel ships

CloudLinux and TuxCare both flag these as partial and untested against this exact bug. Try them on a non-critical guest first.

Turn off checksum offload for untrusted guests

This is the main lever on VPS nodes. In libvirt, add this inside each guest's <interface> element, then fully stop and start the guest:

<driver>
  <host csum='off'/>
  <guest csum='off'/>
</driver>

For raw QEMU, use -device virtio-net-pci,netdev=n0,csum=off,guest_csum=off. Check what's already set with virsh dumpxml <domain> | grep 'csum='. Empty output means QEMU defaults, with offload on.

Close the local path on shared servers

sysctl user.max_user_namespaces
sysctl -w user.max_user_namespaces=0
echo 'user.max_user_namespaces = 0' > /etc/sysctl.d/90-no-userns.conf

Then run unshare -Urn as an unprivileged user. If it fails, the local route is closed. This breaks rootless containers and some sandboxes, and does nothing for VM guests. If you already applied it for the KEV kernel CVEs earlier this month or for bridge-stp-uaf, it's already in place.

Install the kernel when it lands

On 7h and 8, yum update kernel && reboot. On 9 and 10, dnf update kernel && reboot. Confirm with uname -r against the version CloudLinux adds to its advisory. Don't read too much into uname -r alone: enterprise kernels backport fixes without bumping the upstream version, so check vendor errata, not the number.

Next steps

• Weigh livepatching against reboot windows in live patching for hosting fleets and KernelCare on cPanel servers.
• Get rebootless coverage for every node with a KernelCare license, or a CloudLinux license for new servers.
• Still on CloudLinux 7 or 8? Plan the move with migrating to CloudLinux OS 10.