Nutanix confirms a critical 9.3-rated Linux kernel flaw across its whole stack before earnings
A 9.3-rated kernel escape that lets a guest read the host now spans all versions of Nutanix's AOS, AHV and Prism Central stack, in the quarter that just closed. The patch-and-reboot bill is arriving in time for the earnings call.
Richard Tang · 3 min read
Nutanix−4.95% — Nutanix, down 4.95 percent today has confirmed the PwnEscape Linux kernel flaw across essentially its whole product line, and it did so quietly: Security Advisory #0059, dated October 27 and marked Critical, covers all versions of AOS (the Acropolis operating system), AHV (its hypervisor), Prism Central (its management plane), NKP (Nutanix Kubernetes Platform), MSP (Nutanix Microservices Platform) and Objects (its object storage) 1 2. No press outlet has reported the advisory 3 4. It is one of twelve Nutanix advisories dated October, five of them rated Critical, four of those in the final fortnight of the fiscal quarter 1 2.
Why a Linux kernel flaw reaches Nutanix at all
The flaw, CVE-2026-99999, sits in the Linux kernel's networking code, the shared layer that keeps one customer's workload off another's host 3. A guest that crafts packets with bad checksum metadata can leak about 32 bytes of host memory per packet, crash the host with two, and, in lab conditions on the researcher's own machines, reach administrator control of the host 3. Kernel maintainers rated it 9.3 out of 10, Critical 3. Paulos Yibelo of pwn.ai found it in three days inside Vercel's $1 million sandbox challenge, using an AI-assisted research harness 3.
The chain matters more than the score. AHV is built on KVM, the Linux kernel's own virtual machine technology, and runs on Linux hosts, so the same kernel defect that touched Vercel touches Nutanix's flagship, the wedge it sells against Broadcom's−5.24% — Broadcom, down 5.24 percent today VMware 3.
The fix is a fleet-wide reboot, and other advisories name the government cloud
Patching means a kernel update and a reboot on every host in a fleet 3. SA #0059's own affected-versions list does not name GC2, the Government Cloud Clusters line sold to governments; but the October 26 Bad Epoll advisory and the October 31 Brotli advisory do name GC2 explicitly, so the October cluster touches the government pipeline even where the PwnEscape list is silent 1.
Twelve Nutanix advisories landed in October, five rated Critical
Data
| Value | |
|---|---|
| Oct 3 | 1 |
| Oct 10 | 2 |
| Oct 15 | 1 |
| Oct 26 | 5 |
| Oct 27 | 1 |
| Oct 31 | 2 |
No attack in the wild, but a commercial clock
There is no sign of real-world use. The attack vector is local, so an attacker needs code already running inside a guest, and the flaw is absent from the catalog of actively exploited vulnerabilities kept by CISA, the U.S. Cybersecurity and Infrastructure Security Agency 3. Vercel reported no customer data read in its challenge 3. The only public trace of Nutanix's advisory is a Reddit thread complaining that r/nutanix moderators removed the topic 4.
The discovery economics sharpen the point: a critical kernel escape found in three days for under $700 in API tokens means this class of flaw is now cheap and fast to find, and pointed at every vendor's virtualisation layer 3. Vendors' only defense is patching at the rate AI-assisted research now finds flaws, which for Nutanix means fleet-wide kernel updates and reboots 3.
What to watch on the call
Nutanix reports fiscal first-quarter results in the coming weeks, and both October 31 advisories and the PwnEscape advisory landed inside that quarter's final weeks 1. Patch-and-reboot campaigns across whole fleets are the kind of work that pushes deals out, and a Broadcom sales team now has a Critical advisory on all versions of the stack it wants customers to leave 1 2 3. Watch the earnings call for deal slippage and security-trust questions.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
