Skip to content
Critical Linux KVM Guest-Host Escape Vulnerability Disclosed

Critical Linux KVM Guest-Host Escape Vulnerability Disclosed

First seen 19 Oct 2026, 07:48 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 19, 2026 at 08:48 UTC
  • •CVE-2026-99999 rated 9.3 critical for Linux KVM guest-host escape vulnerability.
  • •Public PoC available since March 20, 2026, increasing risk of exploitation.
  • •No active exploitation reported, but potential for severe impact on affected systems.

A critical vulnerability, CVE-2026-99999, has been identified in Linux KVM that allows guest-to-host escape, rated 9.3 on the CVSS scale. This flaw could enable attackers to execute arbitrary code on the host system from a compromised guest environment. The vulnerability was publicly disclosed on October 15, 2026, with proof-of-concept code available since March 20, 2026. Affected systems include various Linux distributions utilizing KVM for virtualization. As of now, there is no indication of in the wild, but the potential for serious impact remains high due to the nature of the vulnerability. Administrators are urged to monitor for updates and apply patches as they become available.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-03-20
First public PoC released
Proof-of-concept code for CVE-2026-99999 was made publicly available, raising concerns about potential exploitation.
Theregister
2026-10-15
CVE-2026-99999 published
Critical vulnerability in Linux KVM allowing guest-to-host escape disclosed with a CVSS score of 9.3.
Theregister

More articles in this cluster (2)

Following this threat?

Track CVE-2026-99999 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 3

Common questions

What systems are affected by CVE-2026-99999?
Various Linux distributions using KVM for virtualization are affected by this vulnerability.
Is there any active exploitation of this vulnerability?
Currently, there are no reports of active exploitation in the wild for CVE-2026-99999.
What should administrators do in response?
Administrators should monitor for updates and apply patches as they become available to mitigate risks.