---
title: Tip: patch PwnEscape on the host side first, since the guest is the attacker | ctxsec
url: https://ctxsec.com/items/tip-pwnescape-host-kernels
description: ""
status: "how-to"
published: 2026-10-15
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-pwnescape-host-kernels.md)

how-to

2026-10-15

### Tip: patch PwnEscape on the host side first, since the guest is the attacker

CVE-2026-99999 is triggered by a guest's outbound frames and lands in the **host** kernel, so updating guest images does nothing. Inventory hosts that run untrusted or multi-tenant guests over tap/virtio-net (KVM/QEMU, Firecracker, Kata, CI runner fleets, homelab Proxmox nodes hosting other people's VMs) and move them to a kernel at or above 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 or 7.2.11, or your distro's backport. Treat it like a hypervisor patch: schedule host reboots or live-migrate guests off. Single-tenant boxes where you trust every guest are lower priority, but the bug is still there.

Sources: [CVE-2026-99999 record](https://www.cve.org/CVERecord?id=CVE-2026-99999)