CVE-2026-99999 is triggered by a guest's outbound frames and lands in the host kernel, so updating guest images does nothing. Inventory hosts that run untrusted or multi-tenant guests over tap/virtio-net (KVM/QEMU, Firecracker, Kata, CI runner fleets, homelab Proxmox nodes hosting other people's VMs) and move them to a kernel at or above 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 or 7.2.11, or your distro's backport. Treat it like a hypervisor patch: schedule host reboots or live-migrate guests off. Single-tenant boxes where you trust every guest are lower priority, but the bug is still there.