PwnEscape's 9.3 CVSS KVM Flaw Gives VM Guests Root Host Control

Security researchers published technical details for PwnEscape, a vulnerability tracked as CVE-2026-99999 that allows code running in a virtual machine to take control of the host physical server. The flaw affects multiple industry-standard hypervisors using the Linux kernel networking stack and carries a critical CVSS score of 9.3, enabling host-kernel memory reads, controlled writes, and root command execution. The vulnerability was published on October 15, and researcher 0x4d31 reportedly rediscovered it in under 2 hours using OpenAI's gpt-5.6-cyber model after identifying the word "virtio" in a partially redacted Vercel bounty screenshot.