← Sunday, October 18, 2026SecurityVulnerability

PwnEscape turns Linux networking flaws into a KVM guest-to-host escape

pwn.ai 18 min read Editor score 8/10

Researchers describe a Linux networking vulnerability that enabled repeatable host-memory disclosure and a full guest-to-host escape. The findings matter to anyone relying on VM isolation to contain untrusted workloads.

What: PwnEscape is a Linux kernel vulnerability that enabled a guest-to-host escape from KVM and other hypervisor environments.
How: Guest-controlled checksum metadata could rewrite an IPv4 header after validation, enabling host-memory disclosure and ultimately an escape.
Why it matters: The flaw shows that sandbox isolation can fail through the host's networking stack, without exploiting KVM itself.

Guest-controlled traffic exploits Linux networking to influence the host kernel and escape to the host. Sketched from the article's own text.

Read on pwn.ai → Lobsters · 3 comments

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.