# PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)

**URL:** <https://taggartinstitute.org/t/pwnescape-guest-to-host-kvm-escape-cve-2026-99999/864>\
**Category:** Cyber News\
**Tags:** cve\
**Created:** [October 15, 2026, 5:50pm UTC](https://taggartinstitute.org/t/pwnescape-guest-to-host-kvm-escape-cve-2026-99999/864 "2026-10-15T17:50:06Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![mttaggart](https://taggartinstitute.org/user_avatar/taggartinstitute.org/mttaggart/32/10_2.png) [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Post date:** [October 15, 2026, 5:50pm UTC](https://taggartinstitute.org/t/pwnescape-guest-to-host-kvm-escape-cve-2026-99999/864/1 "2026-10-15T17:50:07Z")

</div>

This is a fun one. The full chain has not been published, but this is one to watch.

> **[PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)](https://pwn.ai/blog/pwnescape)**
>
> How a $1 million sandbox challenge led pwn to a Linux CHECKSUM\_PARTIAL trust-boundary bug: a post-validation IPv4 header mutation, a 32-byte host-memory disclosure, and an owned-host VM escape.