Serious Linux kernel vulnerability allows access to remote computers
Hacks.grA new networking vulnerability, PwnEscape (CVE-2026-99999), has been identified in the Linux kernel. It allows a virtual machine to escape its bounds and r
A new networking vulnerability, PwnEscape (CVE-2026-99999), has been identified in the Linux kernel.
It allows a virtual machine to escape its bounds and read host memory, with risks including system crashes or arbitrary code execution.
The flaw was discovered by using AI assistance.
Patches have been merged into recent stable branches, including 5.10.272 and 6.12.113.
Developers and system administrators should review their kernel versions and deploy the latest security updates.
What can happen
The vulnerability is in Linux's networking code. If someone has already gained control of a virtual machine, they can send special commands that trick the host computer. This allows them to read the system's memory, cause a crash, or even execute their own code on the host system.
The problem was discovered by the pwn.ai research team during a Vercel competition. The researchers used artificial intelligence to identify the vulnerability in just three days.
Who it concerns
PwnEscape affects any service provider that hosts multiple virtual machines on the same host. However, there is no evidence that the issue has been used in real-world attacks to date.
READ ALSO
Urgent security update for Next.js that fixes three serious issues
It is important to note that the would-be attacker cannot remotely attack a random computer. They must already have managed to run their own code inside a virtual machine that the affected system is using.
Correcting the problem
Linux developers have already released patches to fix the issue in all recent kernel versions, including 5.10.272 and 6.12.113. System administrators need to install the patch on the host computer and reboot their system to complete the protection process. An update inside the virtual machine alone is not enough, as the issue affects the software that manages the host system.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source