Skip to main content
Sign in

TuxCare Knowledge Base

  1. TuxCare
  2. KernelCare
  3. Articles

CVE-2026-99999 (Pwnescape) live patch ETA

Karina Aparicio
  • Updated

Issue

What is the ETA for the KernelCare live patch (or ELS kernel update) for CVE-2026-99999 (Pwnescape), a KVM guest-to-host escape disclosed on 2026-10-15? Which distributions and kernels will be covered?

Environment

  • KernelCare
  • TuxCare ELS (kernel)
  • AlmaLinux / RHEL 9 and 10
  • Ubuntu 20.04 (5.4 GA kernel and 5.15 HWE kernel), Ubuntu 22.04
  • CentOS 7 (3.10)
  • Debian 13

Solution

No KernelCare live patch or ELS kernel update has been released yet. Status as of 16/10/26:

  • AlmaLinux / RHEL 9 and 10: a KernelCare live patch is confirmed and development has started. These are first because they have the widest exposure.
  • Ubuntu 20.04 (5.4 GA kernel) and CentOS 7: both kernels are supported and are being assessed for this CVE. There is no ETA yet.
  • Ubuntu 20.04 (5.15 HWE kernel): this kernel line was retired from KernelCare in 2023, and ELS does not cover HWE kernels. Whether any coverage is possible is under internal review, and no patch is promised.
  • Ubuntu 22.04 and Debian 13: no status has been published yet.

The kernel team is developing the live patches from the upstream fix without waiting for vendor updates. There are no reports of active exploitation in the wild.

To check whether a patch is available for your servers:

  1. Collect the output of the following commands from one server of each OS type:

    cat /etc/os-release
uname -r
kcarectl --uname
  2. Check the CVE tracker and the KernelCare patch downloads for the latest status of your distribution and kernel.

Exposure notes:

  • Nested virtualization and exposing /dev/kvm to the guest are not required. The bug is in the host kernel network stack, not in KVM. A root user inside a regular guest with a virtio-net NIC (tap/vhost-net backend) can send crafted packets that the host kernel processes.
  • It cannot be exploited over the network alone. Code execution inside a VM or on the host is needed.

Cause

The vulnerability is in the host kernel networking code (net/ipv4, csum_start handling). The upstream fix was published on 2026-10-15, and live patches have to be built separately for each distribution kernel.

Useful Links

Comments

0 comments

Article is closed for comments.