PwnEscape and the FedRAMP Flaw Remediation Clock

FedRAMP continuous monitoring runs on timeframes. Critical and high flaws get 30 days. Moderate flaws get 90. Low flaws get 180. PwnEscape just started the 30 day clock.

CVE-2026-99999 is a flaw in the Linux kernel's IPv4 stack that lets a guest virtual machine (VM) escape to its host. Crafted packets make the host kernel rewrite a validated header. The result is host memory leaks, host crashes, and code execution as root on the host. The Linux kernel security team rates it 9.3, Critical.

Why the clock matters here

FedRAMP's flaw remediation timeframes are public. A cloud service provider (CSP) with this flaw in its stack must remediate within 30 days of identification and track it in a Plan of Action and Milestones (POA&M).

This flaw punishes CSPs that patch guests on schedule but treat hosts as slow moving infrastructure. The vulnerable code runs on the host. Guest patches change nothing.

Affected kernels run from 2.6.27 through the fixed point releases. The fixed versions include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, and 7.2.11.

The shared responsibility angle

FedRAMP draws the authorization boundary, then assigns each layer to the party that owns it. For Infrastructure as a Service, the provider owns the hypervisor. For Platform as a Service, the line sits higher. For Software as a Service, the customer mostly inherits.

PwnEscape tests whether that inheritance is documented. If your service runs on someone else's hypervisor, your package should show their patch evidence. If you run the hosts, the 30 day clock is yours.

Agencies reviewing a package should ask one question: does the vulnerability scan cover the host kernel, or does it stop at the guest image?

What good evidence looks like

A strong POA&M entry for this flaw names the affected hosts, the current kernel version, the target fixed version, and the remediation date. It records the verification after the patch, not just the patch.

Monthly scan evidence should include the host layer. A scan that only covers guest operating systems misses the layer that enforces isolation between tenants.

What to do this week

CSPs: inventory host kernels across every region and compare against the fixed versions. Agencies: ask your providers for their host kernel patch status in writing.

Thirty days is short when the fix needs host reboots across a fleet. Start the scheduling now.

Sources

• CVE-2026-99999 record, CVE Program. Published October 15, 2026, updated October 19, 2026. CVSS 3.1 base score 9.3, Critical.
• PwnEscape technical writeup, pwn.ai. https://pwn.ai/blog/pwnescape
• FedRAMP Continuous Monitoring Strategy Guide. https://www.fedramp.gov
• Original diagram by PolicyCortex.

Next step

Want flaw remediation evidence that updates itself from the live cloud? See how PolicyCortex collects it on Azure.