"PwnEscape" Guest-to-Host KVM Escape
CVE / CVSS
| CVE | CVSS | EPSS | Vector | Source |
|---|---|---|---|---|
| CVE-2026-99999 (opens in a new tab) Debian (opens in a new tab) | CVSS 9.3 Critical | 0.79 % | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD (v3.1) |
Base scores are looked up from NVD or, if NVD has none yet, the CVE record. Proxmox itself does not publish CVSS scores. “Actively exploited” comes from the CISA KEV catalog, EPSS (probability of exploitation in the next 30 days) from FIRST.
Affected packages
proxmox-kernel
Details
Incomplete validation of network packet checksum metadata when completing the checksum calculation allowed an attacker to read host memory and write host kernel memory via the virtio network stack, allowing an escape from inside a KVM guest.
Fixed in
- proxmox-kernel-7.0.14-24-pve(-signed)
References
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.