According to The Register, a newly disclosed Linux KVM vulnerability has been rated critical with a CVSS score of 9.3. The flaw, tracked as CVE-2026-99999 and dubbed PwnEscape, is a guest-host escape, meaning an attacker inside a virtual machine could potentially break out to the host system.
The report suggests this may represent a new way to attack Linux-powered networking infrastructure. Because KVM is a common hypervisor in cloud and data-center environments, a reliable guest-to-host escape could have broad implications for any organization running Linux virtual machines.
The Register's coverage does not include technical exploit details in the headline, but the critical rating and the 'PwnEscape' moniker indicate the issue is being treated as serious. With only this single source, there is no independent confirmation, but the report frames the flaw as potentially novel rather than a variation of previously known KVM bugs.