--- title: "Nutanix confirms a critical 9.3-rated Linux kernel flaw across its whole stack before earnings" description: "A 9.3-rated kernel escape that lets a guest read the host now spans all versions of Nutanix's AOS, AHV and Prism Central stack, in the quarter that just closed. The patch-and-reboot bill is arriving in time for the earnings call." publisher: "The Inference" section: "Security" published: 2026-11-01T18:13:04.179Z modified: 2026-11-01T18:13:04.179Z canonical: https://theinference.org/article/nutanix-confirms-a-critical-9-3-rated-linux-kernel-flaw-across-its-whole-stack-before-earnings language: en keywords: "Security, Nutanix, Vulnerabilities, Linux, Earnings" --- # Nutanix confirms a critical 9.3-rated Linux kernel flaw across its whole stack before earnings > A 9.3-rated kernel escape that lets a guest read the host now spans all versions of Nutanix's AOS, AHV and Prism Central stack, in the quarter that just closed. The patch-and-reboot bill is arriving in time for the earnings call. [Nutanix](https://theinference.org/markets/companies/nutanix) has confirmed the PwnEscape Linux kernel flaw across essentially its whole product line, and it did so quietly: [Security Advisory #0059](https://download.nutanix.com/alerts/Security_Advisory_0059.pdf), dated October 27 and marked Critical, covers all versions of AOS (the Acropolis operating system), AHV (its hypervisor), Prism Central (its management plane), NKP (Nutanix Kubernetes Platform), MSP (Nutanix Microservices Platform) and Objects (its object storage) [1] [2]. No press outlet has reported the advisory [3] [4]. It is [one of twelve Nutanix advisories dated October](https://portal.nutanix.com/page/security/security-advisories/list), five of them rated Critical, four of those in the final fortnight of the fiscal quarter [1] [2]. ## Why a Linux kernel flaw reaches Nutanix at all The flaw, CVE-2026-99999, sits in the Linux kernel's networking code, the shared layer that keeps one customer's workload off another's host [3]. A guest that crafts packets with bad checksum metadata can leak about 32 bytes of host memory per packet, crash the host with two, and, in lab conditions on the researcher's own machines, reach administrator control of the host [3]. [Kernel maintainers rated it 9.3 out of 10, Critical](https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html) [3]. Paulos Yibelo of pwn.ai found it in three days inside Vercel's $1 million sandbox challenge, using an AI-assisted research harness [3]. The chain matters more than the score. AHV is built on KVM, the Linux kernel's own virtual machine technology, and runs on Linux hosts, so the same kernel defect that touched Vercel touches Nutanix's flagship, the wedge it sells against [Broadcom](https://theinference.org/markets/companies/broadcom)'s VMware [3]. ## The fix is a fleet-wide reboot, and other advisories name the government cloud Patching means a kernel update and a reboot on every host in a fleet [3]. SA #0059's own affected-versions list does not name GC2, the Government Cloud Clusters line sold to governments; but the October 26 Bad Epoll advisory and the October 31 Brotli advisory do name GC2 explicitly, so the October cluster touches the government pipeline even where the PwnEscape list is silent [1]. *Chart: **Twelve Nutanix advisories landed in October, five rated Critical** Bar chart of Nutanix security advisories by date in October 2026, showing 1 on Oct 3, 2 on Oct 10, 1 on Oct 15, 5 on Oct 26, 1 on Oct 27 and 2 on Oct 31, twelve in total, five rated Critical.* *Count of Nutanix security advisories by publication date in October 2026, from the Nutanix support portal advisory list. Five of the twelve are rated Critical (one each on Oct 10, 15 and 27, two on Oct 31); the Oct 26 cluster is five High advisories. [1]* ## No attack in the wild, but a commercial clock There is no sign of real-world use. The attack vector is local, so an attacker needs code already running inside a guest, and the flaw is absent from the catalog of actively exploited vulnerabilities kept by CISA, the U.S. Cybersecurity and Infrastructure Security Agency [3]. Vercel reported no customer data read in its challenge [3]. The only public trace of Nutanix's advisory is [a Reddit thread](https://old.reddit.com/r/nutanix/comments/1xgt9f7/pwnescape_moderated/) complaining that r/nutanix moderators removed the topic [4]. The discovery economics sharpen the point: a critical kernel escape found in three days for under $700 in API tokens means this class of flaw is now cheap and fast to find, and pointed at every vendor's virtualisation layer [3]. Vendors' only defense is patching at the rate AI-assisted research now finds flaws, which for Nutanix means fleet-wide kernel updates and reboots [3]. ## What to watch on the call Nutanix reports fiscal first-quarter results in the coming weeks, and both October 31 advisories and the PwnEscape advisory landed inside that quarter's final weeks [1]. Patch-and-reboot campaigns across whole fleets are the kind of work that pushes deals out, and a Broadcom sales team now has a Critical advisory on all versions of the stack it wants customers to leave [1] [2] [3]. Watch the earnings call for deal slippage and security-trust questions. ## Takeaway Security Advisory #0059 puts the 9.3-rated PwnEscape kernel flaw in every version of Nutanix's AOS, AHV and Prism Central stack, and patching means a kernel update and a reboot on every host. The work landed in the fiscal quarter that just closed, and the earnings call now has to answer for it. ## Sources 1. [Nutanix Support & Insights, Security Advisories list (accessed 1 November 2026)](https://portal.nutanix.com/page/security/security-advisories/list) 2. [Nutanix Security Advisory #0059, CVE-2026-99999 PwnEscape (27 October 2026)](https://download.nutanix.com/alerts/Security_Advisory_0059.pdf) 3. [The Hacker News, Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory (15 October 2026)](https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html) 4. [Reddit r/nutanix, PwnEscape - moderated thread (collected 29 October 2026)](https://old.reddit.com/r/nutanix/comments/1xgt9f7/pwnescape_moderated/) --- Nutanix confirms a critical 9.3-rated Linux kernel flaw across its whole stack before earnings — The Inference. Canonical: https://theinference.org/article/nutanix-confirms-a-critical-9-3-rated-linux-kernel-flaw-across-its-whole-stack-before-earnings