Task: audit and coordinate remediation for CVE-2026-99999 (PwnEscape).

Read the local scripts before executing. Use the platform's native script.
Default audit is offline, uses no scanner service, and sends no inventory away.
Exit 0 means help only; exit 1 means execution failed; exit 2 means assessment
completed but Linux backend/vendor patch evidence remains unresolved.

Do not run a proof of concept, send malformed packets, test memory disclosure,
install remote scripts, add APT repositories, or upload any local report.
Do not record addresses, host names, user names, VM names, or environment dumps.

Inventory the native host and Linux virtual-machine layers separately. Do not
declare Windows or Darwin vulnerable based only on a Linux CVE. A missing app
in this deliberately narrow inventory does not prove no Linux VM exists.

On Ubuntu 26.04, after the owner authorizes the kernel-package maintenance,
run: sudo bash pwnescape-ubuntu.sh --apply --out audit-after-update.json
This upgrades only supported INSTALLED kernel metapackages from configured
repositories. Failures and unknown tracks must remain unresolved. A successful
package operation is not proof the CVE patch is included or active.

On Windows 11, after authorization for the WSL update, run:
powershell -NoProfile -File .\pwnescape-windows.ps1 -UpdateWSL
Use -RestartWSL only with authorization to stop all active WSL workloads.
On macOS 27, audit with zsh pwnescape-macos.zsh and follow the identified Linux
backend vendor's documented update channel. Do not invent a universal VM update.

Ask for the exact vendor advisory and fixed package/build for the actual track.
As checked on 2026-10-19, Ubuntu's linux/26.04 row said Needs evaluation.
Never turn this into Fixed without new authoritative evidence.

Before a reboot or backend restart, preserve work and obtain maintenance-window
authorization. After activation, re-run inventory. Match the RUNNING Linux
kernel's package/build to the vendor fix (or exact equivalent patch evidence),
then test normal network/application behavior. Livepatch requires explicit
coverage of this CVE, not merely an enabled livepatch service.

Return: evidence sources, layers checked, changes made, activation status,
verification results, and unresolved items. Keep all reports local and private.