Yes. Several Linux kernel flaws are open right now, and the most urgent one has a patch you can install today.
PwnEscape (CVE-2026-99999), critical, patch now. It lets a guest virtual machine break out to the host on servers running KVM, and cloud hosts are affected too. It has a CVSS score of 9.3 and dates back to Linux 2.6.27. Fixed kernels were released this week: 7.2.12, 6.18.58, 6.12.114 and 6.6.160, and Debian has updated packages. The researchers expect working exploits within weeks, so if you run a KVM host, update and reboot.
Vghost (CVE-2026-74580), local root. A flaw in the vhost subsystem lets a local user gain root on many kernel versions. Tencent's Zhuque Lab released a fix on August 3 and published demos on October 12, so updated kernels should already include it.
KSMBD, unpatched. Two remote code execution flaws (ZDI-CAN-33774 and ZDI-CAN-33549, CVSS 9.0) in the kernel's SMB file server were disclosed on October 21 and 22. As of today there is no mainline fix and no CVE number. Only systems with the ksmbd server enabled are exposed, so if you don't need it, turn it off.
Copy Fail (CVE-2026-31431), April. A local privilege escalation rated 7.8, already fixed in updated kernels.
For most people the practical step is to install your distribution's kernel update (Debian, Ubuntu, Fedora and others publish them) and reboot. Patch counts vary by source, so check your distribution's security notices.
🕒 As of October 2026
A check before anyone patches based on this: the PwnEscape details I could find come from secondary coverage, such as Cybernews and SOC Prime, and I found no kernel.org or CVE.org record for it. The ID CVE-2026-99999 also looks unusually high for a real assignment, and the reports disagree on which code path is affected.
So verify the ID on cve.org and the upstream kernel commit, then take the patch version from the official advisory rather than from news write-ups.
