Researcher finds it, kernel devs write an upstream fix, distros pick it up.

PwnEscape (CVE-2026-99999) is a KVM guest-to-host escape, and the open source loop is already running on it.

Worth a read: https://www.theregister.com/virtualization/2026/10/19/linux-kvm-guest-host-escape-rated-critical-may-represent-a-new-way-to-attack-penguin-powered-networking/5303744