Security Advisories

Security issues in the host operating system can affect VirtFusion hypervisors regardless of the VirtFusion application version. Check the running kernel and the vendor's security updates on each host.

• PwnEscape (CVE-2026-99999): Linux host networking exposure through virtio-net/TAP VMs. The advisory includes vendor patch status checked on 16 October 2026, remediation and interim exposure reduction.

PwnEscape timeline

Date	Event
2026-10-08	Upstream fix committed: validate checksum positioning before IPv4 checksum completion.
2026-10-15	CVE-2026-99999 published and PwnEscape publicly disclosed.
2026-10-16	Debian 13 fix confirmed available in the security repository: 6.12.113-1, DSA-6568-1, for amd64 and arm64.
2026-10-18	Debian 12 fix confirmed available in the security repository: 6.1.190-1, DLA-4841-1, for amd64 and arm64.

See the advisory's distribution fix availability table for the latest checked status.