The Linux kernel project is finalizing four stable releases this week, 7.2.12, 6.18.58, 6.12.114, and 6.6.160, each on a different maintenance track from newest mainline to oldest LTS. All four inherit the fix for CVE-2026-99999, a critical guest-to-host VM escape nicknamed "PwnEscape" that dated back to Linux 2.6.27. Patch volume is staggering, with 6.6.160 carrying 1,674 fixes after nearly three years of backporting while the fresh 7.2.12 needs just 10. Linus Torvalds calls this volume "the new normal," driven by AI-assisted review, and operators' best move is simply to update to the newest point release for their branch and reboot.

Linux finalizes four stable kernel releases, all carrying the 'PwnEscape' fix

6.6.160 alone ships 1,674 patches as Greg Kroah-Hartman closes the review cycle for the newest mainline and its three LTS tracks.

The Linux kernel is putting the finishing touches on four stable releases this week: 7.2.12, 6.18.58, 6.12.114, and 6.6.160. They all inherit a critical security fix landed just days ago. One ships with more than 1,600 patches on top of an already massive base.

That last number is worth sitting with. 6.6.160 is a point release for a kernel first shipped in October 2023, and it has been accumulating fixes for nearly three years. That single review cycle carries 1,674 patches. By contrast, 7.2.12 sits on the freshly merged mainline and needs just 10.

Here's the thing about the kernel: it isn't one version number. It runs on several tracks at once. Linus Torvalds merges mainline where new features land, roughly every nine to ten weeks. Greg Kroah-Hartman keeps the stable and long-term-support lines patched for years, backporting fixes from mainline. These four releases aren't competing products. They're four different audiences in one batch.

What's actually changing

I'll skip the full feature dump. You almost certainly don't need to know that 7.2 shipped a "fairer" GPU scheduler or a USB4 stream device at /dev/tbstreamX unless your hardware happens to agree.

For what it's worth, the single most viral feature of 7.2 was arguably nothing anyone expected: a QR code that appears on panic screens carrying debug information. When your kernel crashes, apparently the very first instinct is to scan a barcode.

The important part, though, is that all four inherit the fix for CVE-2026-99999, the flaw that's been nicknamed "PwnEscape" for reasons that are genuinely hard to argue with.

The vulnerability lives in the IPv4 networking subsystem and dates all the way back to Linux 2.6.27. Malformed checksum metadata can reach a function called skb_checksum_help(), which then writes attacker-controlled bytes into an IPv4 header the kernel had already accepted. From inside a guest virtual machine, the result can be host memory disclosure, a crash, or, shown only in a lab so far, host code execution as root. That makes it a guest-to-host escape, which is the kind of flaw that keeps cloud operators up at night.

The vulnerability is critical, landing at 9.3 on the CVSS scale, or 8.8 per Red Hat. The fix came from Michael S. Tsirkin of Red Hat. He validates the checksum position before finishing the work, a clean "defense in depth" measure. It was merged into mainline on 14 October 2026 and the whole fleet of maintained trees was updated in a single day.

Discovery credit goes to Paulos Yibelo of PWNAI Research, who found it during Vercel's public sandbox challenge and reported it privately on 4 September. If you're keeping score, the previous batch, the .11, .57, .113, and .159 releases that shipped on 15 October, already had this patched. This week's releases just stack more on top.

Keep in mind that CVE counts look alarming and mostly aren't. At Kernel Recipes 2026, Greg noted that the kernel now issues roughly 33 CVEs a day, up from about 50 a week a year earlier. His message was blunt: do not panic. Always update the kernel, and you're all good.

The new normal

Linus Torvalds described Linux 7.2's large fix volume as "the new normal," pinning much of it on AI-assisted review. Several patches across the recent batches now carry an "Assisted-by: Claude" attribution. That's no longer a novelty in this project.

The point isn't that AI is doing the work for us. It's that the review pipeline has scaled so hard that humans can't keep up by hand. Greg once walked through an AI tool's report that flagged 79 "vulnerabilities" in Linux, separating real issues from noise one line at a time. That's the reality of it: 79 flags, a good chunk of them wrong, and one person working through them manually.

It's a rather counterintuitive result. AI helped generate the code and apparently helped find problems inside it, yet the human response to all of it is still simply update and reboot.

What you should do

Run the newest point release for your branch and reboot. The patches don't take effect until a restart, so systems that can't afford downtime need live-patching instead. Target at least 6.6.160 if you're on the oldest LTS, 6.12.114 for the mid-life track, 6.18.58 for the freshest long-term line, and 7.2.12 if you're rolling mainline stable.

Watch which version your distro actually ships. The preceding batch is what most distributions package right now, and the .12, .58, .114, and .160 releases were in the final hours of their review as of this writing. If no regressions show up, they finalize within days. Should anything break, an rc2 cycle simply follows.

The four releases carry the usual mix of backported bugfixes, so even the feature-rich 6.18 and 6.12 lines stay mostly about stability rather than new toys. 6.12 gained real-time support after roughly two decades of effort. 6.6 is where the EEVDF scheduler first shipped, replacing a decades-old algorithm. But by the time a point release lands, all of that history is just fixes stacked neatly on top.

Linux kernel 7.2.12 released

Linux kernel version 7.2.12 is now available:

Full source: https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.12.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v7.x/patch-7.2.12.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.12.tar.sign

You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v7.2.12/v7.2.11

Linux kernel 6.18.58 released

Linux kernel version 6.18.58 is now available:

Full source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.58.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v6.x/patch-6.18.58.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.58.tar.sign

You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v6.18.58/v6.18.57

Linux kernel 6.12.114 released

Linux kernel version 6.12.114 is now available:

Full source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.12.114.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v6.x/patch-6.12.114.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.12.114.tar.sign

You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v6.12.114/v6.12.113

Linux kernel 6.6.160 released

Linux kernel version 6.6.160 is now available:

Full source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.6.160.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v6.x/patch-6.6.160.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.6.160.tar.sign

You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v6.6.160/v6.6.159