CVE-2026-99999 https://pwn.ai/blog/pwnescape
省流：kvm guest 无 root 逃逸到 linux host；5.6-sol $700；影响内核 >= 2.6.27 (2008)
省流：kvm guest 无 root 逃逸到 linux host；5.6-sol $700；影响内核 >= 2.6.27 (2008)
PWN.AI
PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)
How a $1 million sandbox challenge led pwn to a Linux CHECKSUM_PARTIAL trust-boundary bug: a post-validation IPv4 header mutation, a 32-byte host-memory disclosure, and a reliable full host VM escape.
