If PwnEscape Hit Your Network, DFARS 252.204-7012 Starts a 72 Hour Clock

DFARS is the Defense Federal Acquisition Regulation Supplement. Clause 252.204-7012 covers safeguarding and incident reporting for covered defense information. (DFARS 252.204-7012)

CVE-2026-99999 is a flaw in the Linux kernel's IPv4 stack. A guest virtual machine (VM) can send crafted packets that let it read host memory, crash the host, or run code as root on it. The Linux kernel security team rates it 9.3, Critical.

The flaw lives in the host kernel, not the hypervisor. Patching guests does not fix it.

When the clause applies

The clause requires a rapid report when a cyber incident occurs on a covered contractor information system or involves covered defense information. The report goes to the Department of Defense Cyber Crime Center (DC3) through DIBNet. The deadline is 72 hours from discovery.

A guest-to-host escape is exactly the kind of event the clause covers. If an attacker uses it to reach a host that holds covered defense information, that is a cyber incident. If you cannot rule out access to that information, treat it as one.

The detection problem

Most contractors log guest activity. Fewer log host kernel exploitation. PwnEscape's demonstrated effects include host memory disclosure, which leaves little trace in guest logs.

This is the point of the 72 hour rule. The Department of Defense wants the report fast, before the forensics are complete. Waiting for certainty misses the deadline.

Your incident playbook should name who decides a VM escape is a cyber incident. That decision starts the clock.

What the report needs

The DIBNet report covers the incident basics: what happened, which systems were involved, and what information may have been affected. For this flaw, the affected system list must include the hosts, not just the guests.

Keep the patch record with the incident record. The affected kernels run from 2.6.27 through the fixed point releases: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, and 7.2.11.

What to do this week

Patch your virtualization and container hosts first. A patched host removes the incident before it starts.

Then check your playbook. If it does not name the DIBNet reporting path and the 72 hour deadline, fix it now. The clock starts at discovery, not at certainty.

Sources

• CVE-2026-99999 record, CVE Program. Published October 15, 2026, updated October 19, 2026. CVSS 3.1 base score 9.3, Critical.
• PwnEscape technical writeup, pwn.ai. https://pwn.ai/blog/pwnescape
• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting
• Original diagram by PolicyCortex.

Next step

Want incident evidence assembled from the live system instead of from memory? See how PolicyCortex collects it on Azure.